The module presently determines if the limit has been reached by checking for the existence of $_GET['f'][{limit}], where {limit} is the configured limit: https://git.drupalcode.org/project/facet_bot_blocker/-/blob/8c0f01963408...
The limit can be exceeded by manually skipping the given offset, changing $_GET['f'][{limit}] to $_GET['f'][{limit + (n > 0)}]. While links generated in a page might not natively be constructed in such a manner, it's a relatively simple change that might be made in the URL. that doesn't seem unreasonable that some bots might attempt
Enabled/configure module.
Navigate such that the limit is reached.
Alter the GET query parameter on the limit to be past the limit, manually.
Change to count the number of entries in $_GET['f'] to determine if the limit has been reached, instead of probing a single offset.
Active
1.0
Code
Thanks, yeah, it crossed my mind while I was putting it together, but thought it would save some minor compute cycles to just check for the presence of the limit than anything else. I suppose the MR is reasonable though. Will merge later.
Automatically closed - issue fixed for 2 weeks with no activity.