About this plugin
PPL Search Suite improves WooCommerce discovery without tracking or an external search service.
The plugin includes:
- Local autocomplete suggestions for standard WooCommerce product search forms.
- A read-only, bounded REST endpoint that returns published product suggestions.
- Related-product and top-seller recommendations.
- The [ppl_search_suite_recommendations] shortcode.
- An optional recommendation section on single-product pages.
- Bounded settings for search length, result counts, stock filtering, and recommendation mode.
All searches and recommendations use product data stored on your WordPress site. The plugin does not send search terms, product data, or visitor data to a third party.
External services and privacy
PPL Search Suite does not contact an external service. Product searches and recommendations run against WordPress and WooCommerce data on your own site.
The plugin does not add analytics, telemetry, advertising, or visitor tracking. It does not send search terms, product data, settings, or visitor data to PPL DS or another provider.
To protect the public suggestions endpoint from request bursts, the server derives a site-specific, keyed pseudonym for each request interval. For guests, it briefly processes the connection’s IP address in memory; signed-in requests use the local account ID. The limiter stores the pseudonym, counters, and an independent random key for that interval, not raw IP addresses, account IDs, or page tokens.
The key expires with the counter interval and does not reuse WordPress authentication secrets. It ignores proxy-forwarding headers and does not create a cookie or browser-storage identity.
Guests behind the same public connection address share a 90-request budget for the interval. Different connection addresses and signed-in accounts have separate budgets, subject to the shared endpoint limit of 600 requests per interval. An interval lasts 60 seconds; changing a page token does not create a new budget.
Sites behind a reverse proxy should ensure the web server supplies the intended connection address; otherwise visitors may share the proxy’s budget. When the bounded counter map is full, new client identities wait for expiry.
Counters stop applying when their interval expires. Stored expired records are replaced on a subsequent successful counter write or removed by scheduled WordPress cleanup; expiry does not promise immediate physical deletion. These local counters are used for request limiting, not analytics or visitor profiles.