Plugin Directory: Search: Only boost whole-slug matches, to prevent slug squatting. See #8225.#682
Plugin Directory: Search: Only boost whole-slug matches, to prevent slug squatting. See #8225.#682dd32 wants to merge 1 commit into
Conversation
…lug squatting. The slug boost is meant to reward searches looking for a specific plugin by its slug (e.g. `wordpress-seo`), not topic searches that happen to share one word with a slug. Because `slug_text` is word-tokenized and was part of the high-weight title `most_fields` clause, a single-word query like `map` matched a fragment of every `*-map(s)` slug and collected the full slug boost, letting plugins squat on common terms via their slug. Match the query against the whole-slug `slug` keyword field instead, normalised with `sanitize_title()`, via a `constant_score` clause. Slug searches still hit the expected plugin, while a single common word only matches a plugin whose entire slug is that word. See #8225. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
There was a problem hiding this comment.
Pull request overview
Updates the Plugin Directory’s Jetpack/ElasticSearch query boosting to prevent “slug squatting” by ensuring the high-weight slug boost only applies when the user’s query matches an entire plugin slug (after sanitize_title() normalization), rather than matching individual slug tokens.
Changes:
- Removes
slug_textfrom the high-boost titlemulti_matchclause to stop partial slug-token matches from receiving the full boost. - Adds a
constant_score+termquery against the whole-slugslugkeyword field (normalized viasanitize_title()), so only full-slug queries get boosted. - Adds in-code rationale documenting the squatting vector and the intended new behavior.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // still scores a decisive, constant boost, while a single common word | ||
| // only matches a plugin whose entire slug is that word. | ||
| $slug_candidate = sanitize_title( $search_phrase ); | ||
| if ( $slug_candidate ) { |
Refiles #674 from dd32/wordpress.org due to GitHub Sync deleting branches.
Fixes the slug boost in plugin search so it rewards searching for a plugin by its slug without letting plugins squat on common keywords via their slug. See https://meta.trac.wordpress.org/ticket/8225.
Problem
slug_textwas part of the high-weight (boost: 5)most_fieldstitle clause.slug_textis word-tokenized —wp-google-maps→wp,google,maps— so a generic single-word query likemapmatched a fragment of every*-map(s)slug and collected the full slug boost. This is a slug-squatting vector: stuffing a popular term into a slug buys ranking on that term.Concretely, for the query
map, every plugin withmapas one slug word got the boost, and the only top results without it (wp-google-maps,google-maps-widget, whose slugs containmaps, notmap) were the ones penalised — the opposite of intent.Fix
Match the query against the whole-slug
slugkeyword field, normalised withsanitize_title()(the same function that generated the slug), via aconstant_scoreclause. The slug boost now fires only when the query is the plugin's identifier, not when it shares one word with it.slug_textis removed from the titlemost_fieldsclause; title matching is unchanged.Behaviour — slug-searches still match the expected plugin
mapmapmap) — squatting preventedmapsmapswp-google-mapswp-google-mapswp-google-maps✓WP Google Maps(spaces)wp-google-mapswp-google-maps✓wordpress-seowordpress-seowordpress-seo✓leaflet-mapleaflet-mapleaflet-map✓contact-form-7contact-form-7contact-form-7✓woocommercewoocommercewoocommerce✓ (single-word brand slugs still match)Verified against the live index: single common words (
map/maps) match zero whole-slugs, while every real slug search returns exactly its plugin with a flat, predictable score.