
While not a security fix, prevent sensitive scripts from being indexed:
If a site found via inurl:php?id=1 is vulnerable, it could be exploited using techniques such as:
In 2019, a researcher found a site using inurl:php?id=1 for a "legacy support portal." They added ' (a single quote) to the ID. The server returned an error containing the raw database password. That password worked for the admin FTP server. Inside FTP were backup files for a cryptocurrency exchange's hot wallet. Reward: $50,000 bug bounty.
The initial vector? A Google search for inurl:php?id=1 "Fatal error".