diff --git a/app/controllers/directory_items_controller.rb b/app/controllers/directory_items_controller.rb
index 8234d328bc7..8cc9ef58a4a 100644
--- a/app/controllers/directory_items_controller.rb
+++ b/app/controllers/directory_items_controller.rb
@@ -2,6 +2,8 @@
 
 class DirectoryItemsController < ApplicationController
   PAGE_SIZE = 50
+  PAGE_LIMIT = 10
+
   before_action :set_groups_exclusion, if: -> { params[:exclude_groups].present? }
 
   def index
@@ -58,7 +60,7 @@ class DirectoryItemsController < ApplicationController
     end
 
     result = result.includes(:user_stat) if period_type == DirectoryItem.period_types[:all]
-    page = fetch_int_from_params(:page, default: 0)
+    page = fetch_int_from_params(:page, default: 0, max: PAGE_LIMIT)
 
     user_ids = nil
     if params[:name].present?
diff --git a/spec/requests/directory_items_controller_spec.rb b/spec/requests/directory_items_controller_spec.rb
index d0191a3875d..4da71ed079a 100644
--- a/spec/requests/directory_items_controller_spec.rb
+++ b/spec/requests/directory_items_controller_spec.rb
@@ -43,6 +43,11 @@ RSpec.describe DirectoryItemsController do
       get "/directory_items.json", params: { period: "all", page: 0 }
       expect(response.status).to eq(200)
     end
+
+    it "has a page number limit" do
+      get "/directory_items.json", params: { period: "all", page: described_class::PAGE_LIMIT + 1 }
+      expect(response.status).to eq(400)
+    end
   end
 
   context "with exclude_groups parameter" do