SearchStax Drupal module version 1.10.0 and later includes optional flood controls that mimic the query rate limiting previously available with Acquia Search. Flood controls protect the SearchStax-backed search index from excessive or abusive requests that can impact performance or exceed subscription limits.

This page covers the following:

• Understanding flood controls

• Benefits of flood controls

• Prerequisites

• Enabling flood controls

• Managing users who trigger flood controls

• Migrating from Acquia Search

Understanding flood controls

Flood controls, also known as rate limiting, restrict the number of search requests sent in a specific time period. Flood limits use a sliding time window and a maximum request count:

• Window: The number of seconds Drupal checks.
• Limit: The maximum number of requests Drupal permits during that window.

When requests exceed the configured limit during the active window, Drupal suppresses additional requests until traffic falls below the threshold, this functionality is based on the Drupal core Flood API.

Benefits of flood controls

Rate limiting prevents automated tools or misconfigured code from overwhelming the system with excessive queries. This approach ensures that you stay within SearchStax subscription limits and preserve peak search performance for users. These controls replicate the specific flood control protections as originally provided by Acquia Search to maintain a stable and secure environment.

Prerequisites

Before you enable flood controls, ensure that:

• The Drupal site uses the SearchStax module for search.
• You upgrade the module to version 1.10.0 or later. For details of the latest release, visit searchstax 1.10.0.
• You review the current flood control configurations if you migrate from Acquia Search classic to apply comparable settings.

Enabling flood controls

• Upgrade SearchStax

  • Back up the codebase and configuration.

  • Update the module through Composer:

    composer require drupal/searchstax:^1.10

  • Run the database updates:

    drush updb

  • Clear the cache:

    drush cr

  • Ensure that the SearchStax module version is 1.10.0 or later.

• Access flood control settings

  • Log in to the Drupal site as an administrator account.

  • Navigate to the SearchStax module configuration page (/admin/config/search/searchstax).

  • Locate the Flood Protection section.

• Configure limits

  • Select Enable Flood Protection.

  • Set the limits for Search Window, Search Limit, Update Window, and Update Limit.

  • Save the changes.

  • Ensure that you monitor search behavior and logs to adjust limits as needed.

  For additional information, visit Configure Flood Limits in the Drupal Module.

Managing users who trigger flood controls

After a user exceeds flood limits, the module responds in the following manner:

• The module code emits the SearchStax flood protection: <type> limit reached.error message. In this message, the type is either Search or Update.

• The module logs an entry that includes the user identifier and the exceeded limit.

Follow these best practices to manage users:

• Use a WAF such as Acquia Edge powered by Cloudflare or Acquia Edge powered by Akamai to comprehensively block bots at the edge.
• Avoid exposing exact limits in user-facing messages.
• Monitor logs to identify abuse or misconfiguration.
• Use settings.php overrides to set different flood limits for development, staging, and production environments.

Migrating from Acquia Search

• Document existing limits: Review historic behavior and limits from Acquia Search.
• Implement comparable limits: Use SearchStax settings to approximate previous limits.
• Test user journeys: Ensure that normal search, autocomplete, and faceting do not trigger rate limits for typical users.
• Monitor post-launch: Check logs and analytics after migration to determine if limits are appropriate.

Configuring flood controls with the Acquia Search powered by SearchStax Drupal module