Name: FinchUI search protection (Z-BlogPHP plugin)
Brand: FinchUI

Block abnormal requests before search and translation

The plug-in covers standard search.php, cmd.php search jumps, and direct ViewSearch calls to complete checksum risk determination before database queries and multilingual translations occur.

Multidimensional limited viewership of CAPTCHA

Perform a fixed window limit viewership of IP, IPv4 /24 or IPv6 /64 network segments, visitors, search terms, and site-wide minute traffic. Call Z-BlogPHP native verification code when the soft threshold is reached, return 429 when the hard threshold is reached, and fuse search when the site-level traffic is abnormal.

Privacy-friendly fixed sharding storage

Run data is written to zb_users/cache/fui_search_guard, using HMAC identification and fixed sharding files, without saving the original IP, original search terms or full request address.

multilingual search linkage

towards FinchUI multilingual websiteThe plug-in publishes the decision result of binding the search term hash and language, and can control the search term translation, page translation API and cache writing; when the protocol is abnormal, it is automatically downgraded to read-only cache.

Search for entrance protection

Complete risk determination before high-cost operations

Unified protection for standard searches, POST search jumps, and direct search view invocations.

core
Strict parameter validation
reject array search termsLimit characters, bytes, words, and page numbersLimit the number of parameters and query string length
core
URL spam search identification
Identify protocol URLs, www, IP, and common bare domain namesSupport this site and custom domain name allowed listPerform decoding only once to avoid bypassing
recommend
Multidimensional limited viewership of
IP and network segmentsVisitors and different search termsThe same search term and the minute traffic of the whole station

Verification and fusing

Soft threshold verification, hard threshold rejection, abnormal fuse in the whole station

Reuse Z-BlogPHP native captcha and CSRF capabilities without introducing external authentication services.

core
Native CAPTCHA
Server level challenge logShort-term HMAC pass cookiesThe server saves the safe return address
core
Lightweight safety response
HTML and JSONHEAD non-responder400, 403, 429, 503 status codes
recommend
manual and automatic downgrades
normal protectionread-only cacheverify allPause search

Privacy and operational data

Fixed sharding, anonymous statistics, do not create massive files

The state is stored in the site cache directory uniformly, and the plug-in upgrade will not overwrite the running data.

core
HMAC anonymous identifier
Do not save the original IP.Do not save original search termsDo not write high-frequency request logs
core
Fixed sharding storage
256 shardingFile Lock and Atomic ReplacementExpired cleanup and entry caps

like11

t like1

version number: 1.0.0

work ID: fui_search_guard

procedural requirements: 1.7.5

PHP version: 7.0

package size: 246.97 KB

202609-29
v1.0.0
The first official version offers complete search protection, limited viewership of layers, captcha, fuses, statistical graphs, and multilingual collaboration.
- newOverride search.php, cmd.php search jumps, and direct ViewSearch calls to perform strict parameter validation before database queries.
- newAdd URL spam search identification, site domain name allowed list, and IP, network segments, visitors, search terms and site-wide traffic limit viewership of.
- newMultiplexing Z-BlogPHP native captcha and CSRF to provide server level challenge records and short-term HMAC pass credentials.
- newProvides 400, 403, 429, 503 lightweight HTML, JSON, and HEAD responses, as well as manual downgrades and search fuses.
- newImplement fixed sharding, locking atomic write anonymous running state and statistics, do not save the original IP and search terms.
- newImplement versions, search term hashes, and language binding protocols with FinchUI multilingual website plugins.
- optimizeAnonymous users maintain default thresholds, login users and captchas are passed through users using independent trust multiples, and trusted states are not superimposed repeatedly.
- optimizeAdd storage maintenance locks, single request preparation caching, storage health monitoring, and security cleanup to reduce the overhead of high concurrent file operations.
- optimizeThe statistics page adds six categories of judgment trend graphs displayed by retention days, and provides Chinese descriptions of the main reason codes.