Configuration

All settings are site settings. Edit them in Site Management > Settings, or in the site's settings.yaml:

config/sites/main/settings.yaml

solrShield:
  uriObfuscation:
    enabled: true
    rejectAction: '403'

URI obfuscation

solrShield.uriObfuscation.enabled

Type: bool
Default: true

Encode tx_solr parameters into _ss, rewrite search forms and reject unsigned requests. When disabled, Solr Shield leaves links, forms and requests alone.

solrShield.uriObfuscation.rejectAction

Type: string
Default: 403

What happens to a rejected request:

403: An empty 403 Forbidden response.
redirect: 302 to the Referer of the request if it has the same scheme, host and port, otherwise to the site root. Only the path and query of the referer are kept.

Bot detection

solrShield.botDetection.enabled

Type: bool
Default: false

Include the bot-detection script and reject Solr requests whose behavioural payload is missing or scores too low (see Bot detection). Autocomplete requests are exempt.

Attention

Visitors without JavaScript can no longer search or follow filter links once this is enabled.

solrShield.botDetection.minFormTimeout

Type: int
Default: 3

Seconds between page load and a search. Faster requests fail one check.

solrShield.botDetection.securityLevel

Type: int
Default: 7

How many of the ten checks must pass. Values outside 0–10 are clamped, so a negative value requires no counted check; webdriver and the 800×600 screen still reject on their own.

solrShield.botDetection.requireInteraction

Type: bool
Default: true

When enabled, a request without any mouse or touch event fails one check.