The + Symbol is nothing in specific, its just a query string appending variables.. (that url with + symbol is also accessible through curl anywayz.) If you are using an Apache server you can put the following in a .htaccess file to block out site stealers: