This situation is quite unfortunate. As much as I believe search should be available to all, I can also empathise with how much grief this bot is causing. I also find the geo blocking suggestions above very useful as a first line of defence if users are known to be from certain places.
I had considered search_allowed_groups initially, but I think perhaps allow_anonymous_search (defaults true) is better. Doing a group-based feature would make certain internal features that depend on search a bit too gnarly.
With the above, when allow_anonymous_search is disabled, all search features (API/UI) are not allowed for anons. Site setting description is indicated as such.
One thing that I was hesitant on is that while this PR and site setting reason is due to griefing, I wonder if allow_anonymous_search disabled should show still show the search text box (that doesn’t work) and encourage the user to sign up/log in. However, I don’t think that should stop this PR from being merged.
I would also prefer if we don’t conflate other features into this specific request that is scoped to /search for now.