maikschneider / solr-shield

1.0.1 2026-10-23 16:04 UTC

Requires

• php: ^8.2
• apache-solr-for-typo3/solr: ^13.0 || ^14.0
• typo3/cms-core: ^13.4 || ^14.3
• typo3/cms-frontend: ^13.4 || ^14.3

Requires (Dev)

• armin/editorconfig-cli: ^2.1
• ergebnis/composer-normalize: ^2.45
• friendsofphp/php-cs-fixer: ^3.64
• helmich/typo3-typoscript-lint: ^3.3
• move-elevator/composer-translation-validator: ^1.3
• phpstan/extension-installer: ^1.3
• saschaegerer/phpstan-typo3: ^2.1 || ^3.0
• ssch/typo3-rector: ^3.0
• symfony/translation: ^7.2
• symfony/yaml: ^7.2
• typo3/cms-install: ^13.4 || ^14.3
• typo3/testing-framework: ^9.5

GPL-2.0-or-later

• Maik Schneider

• security
• solr
• typo3
• psr-15
• typo3-cms-extension
• bot-protection

Published on Packagist.org on 2026-10-23 16:05 UTC

README

TYPO3 extension solr_shield

Protects the EXT:solr search endpoint from bots and crawlers that enumerate tx_solr[…] parameters to generate thousands of unique, uncacheable requests.

Before: /search?tx_solr[q]=foo&tx_solr[filter][0]=type:pages&tx_solr[page]=2
After:  /search?_ss=eyJwIjoidHhfc29sciU1QnElNUQ9…

✨ Features

• Facet, pagination, sorting and other typolink() links carry one signed _ss parameter instead of tx_solr[…]
• Search form fields are renamed in the rendered HTML and get a signed hidden field, so search works without JavaScript
• Unsigned tx_solr requests and suggest requests are answered with 403, or redirected back on the same site
• No template changes, configured per site
• Optional bot detection: a small script scores mouse, touch, scroll and key activity, and requests that fail its checks are rejected, which raises the cost of scripted crawling

Note

Bot detection is off by default. With solrShield.botDetection.enabled, visitors without JavaScript can no longer search.

🔥 Installation

composer require maikschneider/solr-shield

Add the site set Solr Shield (maikschneider/solr-shield) to your site, then flush all caches.

Dependency	Version
PHP	^8.2
TYPO3	^13.4 || ^14.3
EXT:solr	^13.0 || ^14.0

⚙️ Configuration

# config/sites/<site>/settings.yaml
solrShield:
  uriObfuscation:
    enabled: true
    rejectAction: '403'  # or redirect

📙 Documentation

How the signed parameter, the form rewrite and the middleware work, plus known limitations: docs.typo3.org.

🧑‍💻 Contributing

See CONTRIBUTING.md.

⭐ License

This project is licensed under GNU General Public License 2.0 (or later).