@mike8022 It’s certainly something something that I’ve done, because removing items from search can really hit large servers, it’s a known performance issue. So it’s better to not offer search to the bots, so that you can have a more nuanced approach to search for logged in users, and also for people visiting the site. A bot should not ne using search at all, in fact this is a primary part of a DOS attack, to het WordPress constantly searching for none existent pages. So what I’m thinking for my plugin, is to exclude bots from all searches, to give logged in users full search, and to have controls on what site visitors are able to search for. Included in this is the need to have control over the xml sitemap, and to enable hard rules for exactly what site visitors are allow to search for. Include in this a strategy of honeypots and other traps for those with prying eyes.
bbPress tags seem be a bit of a target, as a lot of the security solutions out there do not cover them. it pretty simple to turn those off for not logged in users, and also to choose to turn them off just for bots I reckon, but it shows a comprehensive approach is needed I reckon, and this DOS attack I’m looking at currently is helping my ideas gel into that comprehensive approach. As I see it, ideally, next time I get an attack, I’ll have a single page allowing me to lock down the entire site if I need to.