# Rate-Limit Site Searches

> Limits how many searches one visitor can run per minute and answers the rest with "429 Too Many Requests", protecting your database from search floods.

- Type: PHP
- Runs: Run everywhere
- Category: [Search](https://wpide.com/library/category/search/)
- Tags: search, security, rate-limit
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/rate-limit-site-search/

## Code

```php
// Maximum searches per visitor per minute.
$wpide_search_rate_limit = 20;

add_action( 'template_redirect', function () use ( $wpide_search_rate_limit ) {
    if ( ! is_search() || current_user_can( 'edit_posts' ) ) {
        return;
    }

    $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';

    if ( '' === $ip ) {
        return;
    }

    $key   = 'wpide_search_rl_' . substr( wp_hash( $ip ), 0, 20 );
    $count = (int) get_transient( $key );

    if ( $count >= $wpide_search_rate_limit ) {
        header( 'Retry-After: 60' );
        wp_die( 'Too many searches in a short time. Please wait a minute and try again.', 'Too many requests', array( 'response' => 429 ) );
    }

    set_transient( $key, $count + 1, MINUTE_IN_SECONDS );
}, 1 );
```

## Notes

Visitors are identified by an anonymous hash of their IP address. Behind a proxy or CDN that hides visitor IPs, everyone may share one limit.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Rate-Limit Site Searches" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/