=== TechDex Search Scrape Guard ===
Contributors: techdex
Donate link: https://buy.stripe.com/14AbJ1bp63hF3en6yvdEs0i
Tags: search, security, bots, spam, performance
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 0.4.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Protects public WordPress search from abusive queries before the main search query reaches MySQL.

== Description ==

TechDex Search Scrape Guard is a focused database backstop for public WordPress search.

It rejects malformed or abusive public searches during WordPress request parsing, before the main search query is built. Administration, REST, AJAX, cron, and WP-CLI requests are excluded.

Current protections include:

* Empty and whitespace-only search rejection
* Search character and word limits
* Separate search pagination limits for anonymous and logged-in users
* Chrome 30 automation-signature blocking
* Fixed-slot rate limiting with a bounded 256-row table
* Optional Cloudflare Turnstile verification and a short-lived signed cookie
* Lightweight rejection responses with no theme rendering
* Search noindex enforcement and virtual robots.txt guidance
* A searchable, paginated 250-signature browser log with automatic refresh
* A TechDex dashboard with settings, event-log, changelog, and donation access

Robots directives are guidance for compliant crawlers. They are not a security control.

== Installation ==

1. Upload the `techdex-search-scrape-guard` folder to `/wp-content/plugins/`.
2. Activate the plugin.
3. Open Search Scrape Guard > Settings & Log.
4. Review the default limits.
5. Optionally add Cloudflare Turnstile keys and enable verification.

== Frequently Asked Questions ==

= Does this replace a CDN or WAF? =

No. Edge protection is preferable because it stops abusive traffic before PHP. This plugin is a WordPress-level database backstop.

= Does the rate limiter create a transient for every IP? =

No. It uses a fixed table with 256 hash slots. Collisions evict older occupants instead of creating unlimited keys or object-cache files.

= Are IP addresses logged? =

Raw IP addresses are not retained. The rate limiter stores salted hashes in fixed slots. The bounded operational log stores only masked IPv4 /24 or IPv6 /48 networks, along with the rejection reason, HTTP status, latest search sample, reported browser string, and a coalesced count.

= What information does the operational log retain? =

The log retains at most 250 coalesced signatures. It stores a masked network, rejection reason, HTTP status, latest search sample, reported browser or user-agent string, first and last observation times, and an occurrence count. Clearing the log removes those records immediately, and uninstalling the plugin removes its tables and settings.

= Does this affect WordPress administration or REST search? =

No. Admin, REST, AJAX, cron, and WP-CLI contexts are excluded.

== External Services ==

Cloudflare Turnstile is optional and no data is sent unless a site administrator configures Turnstile keys. Once configured, Turnstile may be used when required verification is enabled or after a search rate limit is reached. The verification page loads Cloudflare's Turnstile JavaScript and submits the visitor's verification token and connection IP address to Cloudflare for validation. This data is sent only when Turnstile is configured and a search request requires verification.

Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

Cloudflare terms: https://www.cloudflare.com/website-terms/

The plugin does not otherwise send search queries, log records, usage statistics, or site data to TechDex or any other external service.

== Privacy ==

Search Scrape Guard stores bounded operational security data locally in the WordPress database. Raw IP addresses are not retained. Search samples and reported user-agent strings may contain information supplied by a requester, so administrators should treat the log as security data and limit dashboard access accordingly.

== Upgrade Notice ==

= 0.4.1 =

Completes the WordPress.org compliance pass, improves form behavior, and clarifies the optional Turnstile integration.

== Changelog ==

= 0.4.1 =

* Completed the WordPress.org guideline and Plugin Check compliance pass.
* Improved autocomplete and password-manager positioning on editable fields.
* Moved plugin-row behavior into a locally enqueued script.
* Clarified when the optional Cloudflare Turnstile service is contacted.

= 0.4.0 =

* Added a TechDex dashboard with Dashboard, Settings & Log, and Changelog tabs.
* Added donation links, creator information, local plugin details, and consistent plugin-row metadata.
* Suppressed unrelated plugin notices on Search Scrape Guard admin screens while preserving plugin-specific notices.
* Added a nonce to Turnstile verification submissions and tightened request input handling.
* Added WordPress.org privacy and external-service disclosures.
* Added suggested text to WordPress's Privacy Policy Guide.

= 0.3.0 =

* Added separate anonymous and logged-in search-pagination ceilings.
* Anonymous visitors default to 15 search-result pages.
* Logged-in users default to 50 search-result pages.
* The logged-in ceiling cannot be saved below the anonymous ceiling.
* Other query validation and rate-limit protections continue to apply to logged-in searches.

= 0.2.1 =

* Removed the redundant daily rejection-summary table and its separate counter writes.
* Made the coalesced operational log the single reporting source.
* Added one-time cleanup of the retired summary option during upgrade.

= 0.2.0 =

* Added a bounded operational log that combines repeat events by browser signature, masked network, reason, and status.
* Added full browser/user-agent strings, latest search samples, occurrence counts, and masked networks.
* Added five-page navigation with 50 signatures per page.
* Added manual and automatic 30-second refresh controls.
* Added text search across browser strings, reasons, masked networks, and search samples.
* Added a direct Settings link on the WordPress Plugins screen.

= 0.1.1 =

* Standardized the plugin author display as Dexter Nelson | TechDex Development and Solutions.

= 0.1.0 =

* Initial development build.
