Today I’m releasing TechDex Search Scrape Guard, a free WordPress security plugin that protects public site search from abusive requests before the main search query reaches MySQL.
I didn’t build this plugin because WordPress needed another oversized security suite. I built it after a real production website experienced severe slowdowns, widespread server errors, and resource exhaustion while automated traffic was repeatedly hitting WordPress search.
During roughly 12¾ hours of access-log analysis, I found 2,015 search requests. Of those, 1,279 identified themselves as Bingbot, while another 653 came from distributed addresses using the same obsolete Chrome 30 user-agent string. The requests included blank searches, unrelated phrases, spam, and repeated trips through search-result pagination as deep as page 15.
The logs didn’t prove that search traffic caused every server failure, and there was no evidence of a WordPress breach. They did show something important: public WordPress search can become an application-layer resource-amplification point.
Why WordPress search can become expensive
A normal article can often be served from cache. A new search phrase may require PHP and MySQL to scan titles, excerpts, and post content, calculate relevance, sort results, join data, and count pages. When automated requests constantly change the phrase or move through deep pagination, much of the benefit of page caching disappears.
That creates an imbalance: a lightweight HTTP request can force the origin server to do disproportionately expensive work.
What Search Scrape Guard does
Search Scrape Guard acts as an early gate for public WordPress search. It evaluates measurable abuse characteristics before the expensive main search SQL runs.
- Rejects blank and whitespace-only searches.
- Limits query length and word count.
- Restricts excessive search-result pagination.
- Blocks identified automation signatures.
- Rate-limits repeated search activity with a cooldown.
- Returns lightweight
404or429responses without rendering the full theme. - Adds
X-Robots-Tag: noindexto rejected requests. - Keeps its rate-limit storage and rejection telemetry bounded.
The plugin preserves administrative searches, REST requests, AJAX, cron, WP-CLI, and authenticated workflows. It also avoids pretending that a claimed crawler name is proof of identity. User-agent strings are easy to fake, so the protection is based on request behavior and configured limits.
A focused layer of protection
Search Scrape Guard isn’t a replacement for a firewall, malware scanner, login protection, caching, or responsible server management. It addresses one narrow but important exposure: anonymous requesters using public WordPress search to generate unnecessary database work.
Robots directives and noindex remain useful for compliant crawlers and search hygiene, but hostile automation can ignore them. SSG adds application-level enforcement so rejected searches stop before the costly part of WordPress search begins.
Learn more about TechDex Search Scrape Guard and download the free plugin.
You can also find it alongside the other focused tools on the TechDex WordPress Plugins page.