If your search usage is higher than you expect, work through the two questions below in order: is my implementation sending more requests than it needs to, and is someone other than my users sending them.
1. Rule out your own implementation
Common causes of avoidable request volume:
- A runaway loop firing thousands of search requests.
- Automatic page refreshes triggering empty searches.
- A misconfiguration producing duplicated or unnecessary requests - for example widgets that search twice per interaction.
Start with the maintained guide, Optimize search request usage, and How do I reduce my cost while using InstantSearch?
It's also worth confirming the number you're looking at is the one you're billed on. Search requests and search operations differ by the number of queries bundled per request - routinely three to five times on a search-as-you-type implementation. See What is the difference between a Search Operation and a Search Request?
2. Find out where the requests come from
Open Indices > Search API Logs in your dashboard. You can inspect each search request and its originating IP, and look for a single IP issuing an unusually high number of requests or repeating the same query. The getLogs method does the same thing programmatically.
For a structured walkthrough, see Monitoring Search Operations.
Search engine crawlers
A large share of unexpected requests often turns out to be legitimate crawlers such as Googlebot indexing your search result pages. This isn't an attack, and the fix isn't rate limiting - it's telling crawlers not to visit those pages, using a correctly configured robots.txt.
Scrapers, bots, and abuse
Hostile traffic, scraping or denial-of-service attempts, needs a different response. See How do I prevent or reduce bot traffic in Algolia Search?, which covers rate-limited API keys, blocking at the CDN or firewall layer, and third-party tools such as Cloudflare Bot Management, AWS Shield, and Akamai.
Fixing it
Algolia can advise, but the change has to be made on your side. In order of how often they help:
- Remove the misconfiguration or loop in your implementation.
- Stop automatic refreshes that re-run searches.
- Exclude search pages from crawlers via
robots.txt. - Issue a new Search API key with a per-IP, per-hour rate limit.
- Add bot protection at the infrastructure layer.