After futher investigation, it's not the page number is limited. I changed the page size to 5, and I can access page up to 200, but not 201 - 400. It seems that it's the result number or the offset number is limited. But I still haven't figured out how to solve this.

Hi Ethan,

I did some debugging using .NET Reflector.
This is the code:

var result = searchHandler.GetSearchResults(new ContentQuery<IContent>(), 101, 10);

EPiServer will make a call to IndexingService.svc, which may look like this:

http://localhost:64483/IndexingService/IndexingService.svc/search/?q=EPISERVER_SEARCH_TYPE%3a(%22EPiServer.Core.IContent%2cEPiServer%22)&namedindexes=&offset=1010&limit=10&format=xml&accesskey=local

If offset is > 1000, I get Bad request, if it's < 1000, I get a nicely formated XML response.

Then, I've debugged EPiServer.Search.IndexingService.IndexingService class.

There's a method protected internal virtual SyndicationFeedFormatter GetSearchResults(string q, string[] namedIndexNames, int offset, int limit) which calls

Collection<ScoreDocument> collection3 = this.GetScoreDocuments(q, true, namedIndexes, offset, limit, IndexingServiceSettings.MaxHitsForSearchResults, out totalHits);

Solution was to open web.config and set maxHitsForSearchResults value on episerver.search.indexingservice element:

<episerver.search.indexingservice maxHitsForSearchResults="20000">
  <clients>
    <add name="local" description="local" allowLocal="true" readonly="false" />
  </clients>
  <namedIndexes defaultIndex="default">
    <indexes>
      <add name="default" directoryPath="[appDataPath]\Index" readonly="false" />
    </indexes>
  </namedIndexes>
</episerver.search.indexingservice>

Hope this helps!