Introduction

Every facet, page and sort order of an EXT:solr search page is a distinct URL such as /search?tx_solr[q]=foo&tx_solr[filter][0]=type:pages&tx_solr[page]=2. Crawlers follow these links and, worse, generate new combinations on their own. Each combination misses the page cache and costs a Solr query, so a single bot can keep both TYPO3 and Solr busy.

Solr Shield takes the tx_solr parameters out of the public surface:

Links generated by EXT:solr and by typolink() carry one opaque _ss parameter instead of tx_solr[…].
Search forms are rewritten so their fields are no longer named tx_solr[…], and they get a hidden _ss field.
Requests that carry tx_solr parameters without a valid _ss are rejected, and so are requests to the suggest endpoint.

All of this happens on the server and needs neither JavaScript nor changes to your Solr templates.

Bot detection

An optional second layer rejects headless and scripted clients. A small script records how the visitor interacts with the page and sends a summary with every search, which the server scores. See Bot detection.