1

Apologies if this is a duplicate posting, I've searched extensively and cannot find either this question or a solution, or even to know if this is really a problem.

I find a LOT of search queries performed on my site where the person or bot is searching for terms like "index/\think\app/invokefunction" and other similar terms. There are obviously no results shown, but the quantity of these searches are overwhelming my search logs, which I use to help me improve my site's content and SEO.

I would ideally like to just ban all special characters (such as / \ ? [] et al) from the search form input field.

So my questions are:

  • is this a potentially security-related problem I should be concerned about?
  • can I ban such characters in the search form?
  • if so, how?

I am not a classically-trained coder but I am very good at following instructions!

Any advice would be appreciated, thanks!

Improve this question
2
  • 1
    Note that bots don't use the search input, bots trying to use exploits don't even bother to check if you're using WordPress, they just fire off the HTTP request, and if their payload works it sends a message back. You could remove your search box completely and it wouldn't stop these. Instead I would focus on making sure you don't log searches from bots, you'll need to look at how you're logging, not the search input or frontend HTML
    – Tom J Nowell ♦
    Oct 13, 2020 at 18:35
  • Thank you Tom - that is helpful.....I use MWT: Search Analytics for the logging so I'll poke around there..... Muchas gracias!
    – Trisha
    Oct 13, 2020 at 19:26

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.