Rate-Limit Site Searches
Limits how many searches one visitor can run per minute and answers the rest with "429 Too Many Requests", protecting your database from search floods.
Opens WPIDE on
Code
// Maximum searches per visitor per minute.
$wpide_search_rate_limit = 20;
add_action( 'template_redirect', function () use ( $wpide_search_rate_limit ) {
if ( ! is_search() || current_user_can( 'edit_posts' ) ) {
return;
}
$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
if ( '' === $ip ) {
return;
}
$key = 'wpide_search_rl_' . substr( wp_hash( $ip ), 0, 20 );
$count = (int) get_transient( $key );
if ( $count >= $wpide_search_rate_limit ) {
header( 'Retry-After: 60' );
wp_die( 'Too many searches in a short time. Please wait a minute and try again.', 'Too many requests', array( 'response' => 429 ) );
}
set_transient( $key, $count + 1, MINUTE_IN_SECONDS );
}, 1 );Notes
Visitors are identified by an anonymous hash of their IP address. Behind a proxy or CDN that hides visitor IPs, everyone may share one limit.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.