Checks the site search page for uncapped page size and empty queries
Fetch — loads the search page with the 37 Audits user agent (Basic auth is honoured). If the page cannot be fetched, or answers HTTP 400 or higher, the audit is ERROR (500).
Detect — asks each visitor whether it recognises the platform. The Liferay visitor matches when the monitored stack lists Liferay, the response carries a Liferay-Portal header, or the HTML contains the Search Results portlet or Liferay.ThemeDisplay. No match is ERROR (501).
Validate — the resultSelector preference must be set (405) and must parse as a CSS selector or XPath (502). Nothing else runs until it does.
Probe (Liferay) — sends four requests to the search page, each bounded by timeoutSeconds:
?q= — empty query, default page size.
?q=* — wildcard query, default page size. Also discovers the Search Results portlet namespace and a pagination link.
?q=&delta=101 — empty query with a page size one above maxDelta (plus the namespaced delta when known).
?q=*&delta=101 — wildcard query with a page size one above maxDelta.
Count — on every answered probe, the elements matching resultSelector are counted. A probe that times out is a FAIL on its own and is not counted.
Redirect chain — links on the wildcard page and on its first pagination page are decoded looking for a redirect parameter that nests another one.
Aggregate — ERROR wins, then FAIL, then WARNING; if every rule passes, the audit is SUCCESS (200).
Every row maps to one checkRule* method and one CheckCode. Codes 500–502, 405 and 200 apply to every platform; 300 and 400–404 belong to the Liferay visitor. A future platform visitor continues the same sequence. CheckCode suffixes use status ranges: 200 success, 300–399 warning, 400–499 fail, 500–599 error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-SearchAuditor-500 | ERROR | The search page or one of the probe requests could not be fetched, or answered with HTTP 400 or higher (for example a WAF returning 403). | Make sure {probeUrl} is reachable by the auditor and returns HTML. | — |
37A-SearchAuditor-501 | ERROR | No visitor recognised the platform (no Liferay in the stack, no Liferay-Portal header, no Liferay markup). | Point this auditor at the site search page of a supported platform ({supported}; for Liferay usually /search) or add the platform to the monitored stack. | — |
37A-SearchAuditor-405 | FAIL | The resultSelector preference is not configured, so results cannot be counted. | Set the resultSelector preference for {url} to the CSS selector or XPath that matches one search result item (for example li.list-group-item). | Until results can be counted, none of the search hardening rules can run, so the search page stays unaudited and its problems go unreported. |
37A-SearchAuditor-502 | ERROR | The resultSelector preference is set but does not parse as a CSS selector or XPath. | Fix the resultSelector preference {selector} so it parses as a CSS selector or an XPath expression. | — |
37A-SearchAuditor-404 | FAIL | Liferay: a probe (?q=, ?q=*, ?q=&delta={maxDelta+1} or ?q=*&delta={maxDelta+1}) did not answer within timeoutSeconds. One check per probe that timed out. | Make {probeUrl} answer within {timeoutSeconds} seconds: cap the pagination delta, disable empty searches and index only what needs to be searchable. | A search that does not answer in time is one visitors give up on, and slow queries triggered by bots can tie up the server for everyone else. |
37A-SearchAuditor-401 | FAIL | Liferay: ?q= (empty query) returned one or more results. | Disable "Allow Empty Searches" on the Liferay Search Bar / Search Results portlet so {probeUrl} returns no results. | An empty query that returns everything exposes the entire index to scraping and turns every accidental or automated empty search into an expensive query for the server. |
37A-SearchAuditor-300 | WARNING | Liferay: ?q=* (wildcard query) returned one or more results, so the whole index can be browsed. | Reject or sanitise wildcard-only queries on the Liferay Search Bar so {probeUrl} returns no results. | A wildcard query lets anyone list and scrape the whole search index, including content that was never meant to be found by browsing. |
37A-SearchAuditor-403 | FAIL | Liferay: ?q=&delta={maxDelta+1} (empty query, page size above the maximum) returned one or more results. | Disable "Allow Empty Searches" and cap the pagination delta on the Liferay Search Results portlet so {probeUrl} returns no results. | An empty query combined with a huge page size is the cheapest way for a bot to dump the whole index and the costliest query the search backend can receive. |
37A-SearchAuditor-400 | FAIL | Liferay: ?q=*&delta={maxDelta+1} returned more than maxDelta results in one page. | Cap the Search Results portlet pagination delta at {maxDelta} or less; {probeUrl} currently returns {count} results in one page. | An unbounded page size lets a single request pull thousands of results, which can overload the search backend and lets scrapers download the whole index in a few calls. |
37A-SearchAuditor-402 | FAIL | Liferay: a link on the results page or on the first pagination page carries a redirect parameter that nests another redirect parameter (depth 2 or more). | Remove the redirect parameter from the Liferay Search Results / Asset Publisher pagination URLs so {pageUrl} links stop nesting the previous URL. | URLs that grow on every page change eventually exceed server limits and fail, and the bloated links hurt sharing, caching and search engine crawling. |
37A-SearchAuditor-200 | SUCCESS | Every platform rule passed. Message is Search page "{url}" passed all {platform} search rules. | — | — |
| Status | Description | Test logic |
|---|---|---|
| SUCCESS | The search page passed every rule of the detected platform | Liferay: every probe answered in time, q= and q=&delta={maxDelta+1} return 0 results, q=* returns 0 results, q=*&delta={maxDelta+1} returns at most maxDelta results, and no link nests a redirect inside a redirect (200). |
| WARNING | The search page can be browsed with a wildcard | Liferay: q=* returns results (300) and nothing else fails. |
| FAIL | The search page is misconfigured or cannot be audited as configured | Missing resultSelector (405); probe timeout (404); results for an empty query (401); results for an empty query with a large delta (403); more than maxDelta results for delta={maxDelta+1} (400); nested redirect parameters (402). Several can fire together. |
| ERROR | The auditor could not run the rules | Search page or probe request failed or returned HTTP 400+ (500); platform not recognised (501); resultSelector does not parse (502). |
Liferay reads the delta parameter to size the results page. Without a cap, ?delta=5000 makes the portal ask Elasticsearch for thousands of documents and render them all, on every request.
Liferay caps delta at 200 by default, but custom themes, fragments and portlet configuration can raise or bypass it. This auditor expects maxDelta (100 by default) or less, and only ever asks for one result more than that.
With "Allow Empty Searches" enabled, ?q= returns every indexed document. That surfaces content that is only reachable by search (drafts, internal pages, documents) and makes scraping trivial.
Liferay portlets append the current URL as a redirect parameter so "back" navigation works. When a pagination link re-encodes a URL that already carries a redirect, every page change nests one more level. After a few clicks the URL is several kilobytes long, breaks caches and proxies, and eventually hits request-line limits.
Links from other portlets on the search page (for example Asset Publisher) are scanned too, because the same mechanism affects them.
Liferay renders every result item server side. A request that cannot answer within timeoutSeconds (default 20) is a sign that the page size or the empty search is not capped, and is reported as a FAIL rather than an auditor error.
Slow but correctly configured sites can raise timeoutSeconds up to 30 per URL.
It does not audit search relevance, indexing coverage, or the search bar on other pages.
If the search index has maxDelta or fewer documents matching *, the delta rule cannot prove a violation and passes.
If the results page has no pagination link, the redirect chain rule only inspects the results page itself.
Counting depends entirely on resultSelector. A selector that matches nothing makes every count rule pass; verify it against the live page when configuring the URL.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.