Develop a feature for whitlisting query string keys.

Keys present in $_GET but not whitelisted should be removed by a redirect.

This will probably only work for basic sites (eg whitelist "page" only). Modules such as ApacheSolr use unpredictable querystring keys. Views also produces querystring keys from exposed filters.