Hi @cpkid1, thanks for reaching out to us!
Generally speaking, Wordfence’s ?wordfence_lh=x&hid=xxx...
query string URLs are used by Live Traffic so are normal to see. wordfence_lh
is checking whether the visitor was detected as human. hid=...
is an encrypted unique identifier so the record can be matched to another in the database.
If Google bots start listing them as “legitimate” site pages, this is usually due to a theme or plugin misconfiguration where any invalid page URLs are being redirected to the homepage. The expected behaviour when these specific URLs are visited is to return a blank page and for Google not to index them for search results.
You may need to consult your theme developer or address any code/plugins that cause this behaviour. Also, clearing/purging any caches such as Advanced Caching plugin and/or server-side caches you may have to reduce the chance of these URLs being served by mistake.
Thanks,
Peter.