Free WordPress Security Plugin
Stop abusive WordPress searches before they become expensive database work.
TechDex Search Scrape Guard rejects empty queries, oversized searches, excessive pagination, identified automation, and search-rate spikes during request parsing—before WordPress runs the main search query against MySQL.
Free, GPL-licensed, and fully functional without a paid upgrade.
Built from a production incident
WordPress search can be used as a resource-amplification surface.
Automated requests were repeatedly sending blank, irrelevant, multilingual, and keyword-loaded searches while walking through result pagination. Each unique search could force WordPress to compare terms across post titles, excerpts, and full content with expensive wildcard conditions.
Search Scrape Guard was created as the WordPress-level backstop: recognize abusive requests early, return a lightweight response, and prevent the expensive main search query from reaching the database.
Early Rejection
Block malformed searches
Reject empty queries, excessive character and word counts, deep pagination, and the identified Chrome 30 automation signature.
Bounded Control
Rate-limit without cache floods
A fixed 256-slot table avoids generating an unlimited transient or object-cache key for every incoming address.
Operational Visibility
Review what was stopped
A bounded, searchable log records masked networks, reasons, counts, search samples, requested pages, and reported browser strings.
Optional Verification
Challenge distributed traffic
Cloudflare Turnstile can verify browsers and issue a short-lived signed cookie when IP-only rate control is not enough.
Focused by design
Protect public search without interfering elsewhere.
Search Scrape Guard affects public front-end WordPress searches only. Administration, REST, AJAX, cron, and WP-CLI requests remain outside the guard.
- Lightweight 404 or 429 rejection responses
- Separate pagination ceilings for visitors and logged-in users
- Search-result noindex enforcement and robots.txt guidance
- Masked IPv4 /24 and IPv6 /48 operational logging
- Local data storage with complete uninstall cleanup
Questions
Search Scrape Guard FAQ
Does Search Scrape Guard stop abusive searches before MySQL runs the main search query?
Yes. It inspects public WordPress search requests during request parsing and ends rejected requests before WordPress builds and executes the expensive main search query.
What types of WordPress search abuse does it block?
It rejects empty searches, overlong searches, excessive word counts, deep pagination, the identified Chrome 30 automation signature, and visitors who exceed the configured search rate.
Will it interfere with WordPress administration or integrations?
No. WordPress administration, REST requests, AJAX, cron, and WP-CLI are excluded. Logged-in users can also have a separate, higher search-pagination limit.
Does the rate limiter create a cache entry for every IP address?
No. It uses a fixed 256-slot database table. Hash collisions replace older occupants instead of creating unlimited transient or object-cache keys.
Is Cloudflare Turnstile required?
No. Turnstile is optional and no visitor data is sent to Cloudflare unless an administrator configures Turnstile keys. The core search protections work without it.
Support
Help keep Search Scrape Guard free and maintained.
If this plugin stopped abusive traffic, protected a client site, or saved database and server resources, consider supporting its continued development. Donations are optional and never unlock hidden features.