I'm looking at creating a Magento based solution to detect bots, specifically on search forms.

I have a bot searching a very specific long tail string and it shows on the dashboard of admin as being searched around 4000 times.

Can I observe the search to limit or strip characters out of the search string before Magento processes it, or at least truncate the length of the query? I tried searching the query myself and it just crashes my session. No other users seem to be affected by it, but I'm sure there is a performance hit elsewhere on the system.

For now I've created a honeypot that renders on the template, then I detect it in index.php and simply kill the script. Trying to find a more bullet-proof solution. Any help is greatly appreciated.

3 Answers 3


Oh interesting question.

What you could do is listen to the event catalogsearch_query_save_before and do something with the query then before you save it. You could even throw an exception if you really wanted to kill the search.

You could also match the query or ip or something and setRedirect on the query object as as the results page is not shown, though I am not 100% sure what the benefit would be for this ;)

Another thing would be to listen to the event controller_action_predispatch check what is in the requested query and then redirect before anything has actually happened.

It is really up to you and what you want to achieve I guess.

  • Yes, an observer would be perfect in this case. I could probably add a session variable to detect someone trying to abuse the search as well, and it would be a more suitable location for detecting a honeypot than just dying at index.php, since you never know when another module might need that query variable.
    – DWils
    May 29, 2014 at 19:04

Just saw, that you already did it... I let this answer here for better explanation and the link :-/

We implemented a few honeypot approaches on a hackathon, which can be found here:


What we did is adding a hidden field (hidden via CSS!) to a few forms. If the forms are filled, a bot did bad things. You can do the same, maybe the bot is dumb enough. Just put a <input type="text"> beside and check for the value, if it is filled, it's a bot.

  • 1
    Very nice, I was aware of a hackathon, but did not know it was on Git. Definitely forking this!
    – DWils
    May 29, 2014 at 19:09
  • 1
    You are invited to send PRs :) May 30, 2014 at 9:39

I did extension for honeypot captcha. Maybe it will be helpful too. It adds honeypot captcha on contacts registration and reviews form http://extensions.sashas.org/honeypot-captcha.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.