---
title: "Cap the size of every search · Agent Wranglers"
url: https://agentwranglers.se/playbook/search/access-and-limits/search-limits
id: SRH-11
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 942
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Cap the size of every search

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Access and limits](https://agentwranglers.se/playbook/search/access-and-limits.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: SRH-11
- Level: Recommended
- Chapter: [Access and limits](https://agentwranglers.se/playbook/search/access-and-limits.md)
- Rule: Reject search text over a fixed length, such as 200 characters, and return a fixed number of hits per page. Stop deep paging at a fixed depth, such as 1,000 hits.
- Check: Send a search of 201 characters. The answer is 400 and names the limit. Ask for page 51 at 20 hits a page. The answer is 400 or an empty page, within the query time limit.
- How: Long input makes many terms, and each term adds index reads. Ranking reads the `tsvector` of every match, so a common word on a large table is slow. Check the length on the server before the query runs, and answer 400 with the limit. Ask for one hit more than the page size to know whether a next page exists, instead of counting every match. Page size caps come from [Set a default page size and a maximum](https://agentwranglers.se/playbook/api-design/lists/page-size-limit.md). Time limits come from [Set time limits on every query](https://agentwranglers.se/playbook/data/operations/query-timeouts.md). Request limits for search come from [Limit requests per client](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/rate-limits.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const MAX_QUERY_CHARACTERS = 200;
const MAX_SEARCH_DEPTH = 1000;
if (query.length > MAX_QUERY_CHARACTERS) return problem(400, `Search text is limited to ${MAX_QUERY_CHARACTERS} characters`);
if (offset + pageSize > MAX_SEARCH_DEPTH) return problem(400, `Search results stop at ${MAX_SEARCH_DEPTH} hits`);
```

### Python example

```python
MAX_QUERY_CHARACTERS = 200
MAX_SEARCH_DEPTH = 1000
if len(query) > MAX_QUERY_CHARACTERS:
    return problem(400, f"Search text is limited to {MAX_QUERY_CHARACTERS} characters")
if offset + page_size > MAX_SEARCH_DEPTH:
    return problem(400, f"Search results stop at {MAX_SEARCH_DEPTH} hits")
```

## Sources

- [PostgreSQL text search controls](https://www.postgresql.org/docs/current/textsearch-controls.html)

## Related rules

- API-22 [Cap the page size](https://agentwranglers.se/playbook/api-design/lists/page-size-limit.md) in API design
- DAT-37 [Set time limits on every query](https://agentwranglers.se/playbook/data/operations/query-timeouts.md) in Data and databases
- APS-49 [Limit how often anyone can call your APIs](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/rate-limits.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/search/access-and-limits/search-limits">Agent Wranglers search playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Filter search results by access inside the query](https://agentwranglers.se/playbook/search/access-and-limits/search-access-filter.md)
- Next: [Keep personal data out of search logs](https://agentwranglers.se/playbook/search/access-and-limits/search-log-privacy.md)
- [Access and limits](https://agentwranglers.se/playbook/search/access-and-limits.md)