---
title: "Configuration"
manual: "SOLR_SHIELD"
version: "main"
permalink: "https://docs.typo3.org/permalink/maikschneider/solr-shield:configuration@main"
source: "Configuration/Index.rst"
rendered: "2026-10-23T16:05:16+00:00"
---

# Configuration {#configuration}

All settings are site settings. Edit them in
**Site Management > Settings**, or in the site's `settings.yaml`:

**config/sites/main/settings.yaml**

```yaml
solrShield:
  uriObfuscation:
    enabled: true
    rejectAction: '403'
```

## URI obfuscation {#configuration-uri-obfuscation}

-   **solrShield.uriObfuscation.enabled**

    -   *Type:* bool
    -   *Default:* true

    Encode `tx_solr` parameters into `_ss`, rewrite search forms and
    reject unsigned requests. When disabled, Solr Shield leaves links, forms
    and requests alone.

-   **solrShield.uriObfuscation.rejectAction**

    -   *Type:* string
    -   *Default:* 403

    What happens to a rejected request:

    -   **`403`**

        An empty `403 Forbidden` response.

    -   **`redirect`**

        `302` to the `Referer` of the request if it has the same scheme,
        host and port, otherwise to the site root. Only the path and query of
        the referer are kept.

## Bot detection {#configuration-bot-detection}

-   **solrShield.botDetection.enabled**

    -   *Type:* bool
    -   *Default:* false

    Include the bot-detection script and reject Solr requests whose
    behavioural payload is missing or scores too low (see
    [Bot detection](https://docs.typo3.org/permalink/maikschneider/solr-shield:how-it-works-bot-detection@main)). Autocomplete requests are exempt.

    > [!WARNING]
    > **Attention**
    >
    > Visitors without JavaScript can no longer search or follow filter
    > links once this is enabled.

-   **solrShield.botDetection.minFormTimeout**

    -   *Type:* int
    -   *Default:* 3

    Seconds between page load and a search. Faster requests fail one check.

-   **solrShield.botDetection.securityLevel**

    -   *Type:* int
    -   *Default:* 7

    How many of the ten checks must pass. Values outside 0–10 are clamped,
    so a negative value requires no counted check; `webdriver` and the
    800×600 screen still reject on their own.

-   **solrShield.botDetection.requireInteraction**

    -   *Type:* bool
    -   *Default:* true

    When enabled, a request without any mouse or touch event fails one check.