Here is what I wound up doing that seems to be working (for now!), it's a combination of two changes;
- Adding some code that prevents special characters from being typed into the search form's input field; and
- Changing the search parameter to something other than the default 's' (which is working at the moment to prevent direct URL access to the WP search function).
Change #1: I added this javascript to my searchform.php template file (it could also go into my Child Theme's functions.php or a custom plugin, this was just the simplest way to add it at the moment, I may move it later):
jQuery(function($){
//Prevent any special characters in form fields with this CSS class name
$( '.char-restrict' ).on( 'keypress', function(e){
var regex = new RegExp("^[0-9a-zA-Z \b]+$");
var key = String.fromCharCode(!event.charCode ? event.which: event.charCode);
if (!regex.test(key))
{
alert ( "Special characters are not allowed in this field" ); // Put any message here
event.preventDefault();
return false;
}
});
//Prevent any paste features in form fields with this CSS class name
$( '.char-restrict' ).bind( 'copy paste', function (e) {
var regex = new RegExp( "@" );
var key = String.fromCharCode(!event.charCode ? event.which : event.charCode);
if (!regex.test(key)) {
alert ( "Pasting feature has been disabled for this field" ); // Put any message here
e.preventDefault();
return false;
}
});
});
NOTE THAT for this to work you need to add the CSS class to the search form's input field, in this case I used .char-restrict, you can make your CSS class whatever you want as long as it matches between the input and your script.
I found the above code at this great tutorial:
https://wpforms.com/developers/how-to-restrict-special-characters-from-a-form-field/
Change #2:
I added the code below to my Child Theme's functions.php file to change the search parameter as all of the spam searches were accessing search directly using URLs with /?s= in them.....when you change the 's' to be something else, they fail (bwahahahah!).
// Change search query parameter to try to stop search spambots
add_filter('init', function(){
global $wp;
if (!is_admin()){
$wp->add_query_var( 'mynewsearch_query' );
$wp->remove_query_var( 's' );
}
} );
add_filter( 'request', function( $request ){
if ( isset( $_REQUEST['mynewsearch_query'] ) ){
$request['s'] = $_REQUEST['mynewsearch_query'];
}
return $request;
} );
I found this code at this great tutorial:
https://searchwp.com/v3/docs/kb/how-to-change-your-search-query-parameter-from-s-to-something-else/
NOTES:
- I added the "if (!is_admin())" statement so it will not impact back-end Admin searches which I do frequently, my version only impacts front-end and direct access searches.
- "mynewsearch_query" is not what I used, I don't want to reveal that here because then someone could use that to once again direct access and spam my search, LOL.....make up your own query parameter name and use that or just use my example as is.
SINCE I implemented these two changes I've had ZERO spam searches.
BUT A HUGE thank you to Rick for his answer above, my next step will be to use his suggestion of a session variable that must exist to access the search input field, this will ensure that only site visitors can use my site search (no direct access) - it's a brilliant solution that I look forward to figuring out.