- Overview
- Features
- FAQ
- Screenshots
- License
- Baskerville AI
Websites constantly receive automated traffic from various bots and AI agents — some of it useful, some harmful. Search engine crawlers help readers find your content and improve your various rankings. Malicious bots can evaluate your website’s vulnerabilities, attempting login attacks, overloading server resources and mimic real users in ways that are difficult to detect. A growing proportion of automated traffic is now scraping your website’s content in order to train some large language model (AI).
Baskerville is a WordPress plugin designed to help you monitor, classify, and control automated traffic. It runs in the background giving you the visibility and tools to manage how bots and suspicious visitors interact with your site.
What Does Baskerville Do?
Baskerville assigns each visitor a risk score based on their browser environment and request characteristics. Based on that score, it can:
- Allow legitimate visitors and search engines through without interruption
- Challenge suspicious traffic
- Restrict or block abusive activity before it causes damage to your website
This results in less spam and fewer attacks, and has no impact on your real visitors.
Baskerville Helps Protect Against:
- Brute-force login attempts
- Automated spam on forms and comments
- Content scraping and AI training crawlers
- AI spoofers — bots that fake legitimate crawler identities (GPTBot, ClaudeBot, etc.) but come from the wrong IP ranges
- Traffic surges that resemble DDoS-style abuse
Why Baskerville Is Different
Many security plugins rely primarily on static IP block-lists or rules and bad actors know it. Baskerville focuses on browser fingerprinting and traffic classification. Instead of blocking everything unknown, it applies graduated responses (allow, challenge, or block). It also gives you per-provider controls: allow Googlebot, block GPTBot, challenge everything in between.
Baskerville is Open Source and Built for Practical Use
Baskerville is designed to work out of the box. After activation, it immediately begins monitoring traffic, no complicated setup required. When you’re ready, use configuration options to fine-tune thresholds, country controls, and verification behavior.
The plugin is open source and actively maintained. Future optional features may expand its capabilities, but the core protection remains available without complex setup.
Bot Control (Detection & Traffic Classification)
- Probabilistic scoring system assigns each visitor a dynamic risk score (0–100) based on browser environment and technical signals.
- Graduated scoring model distinguishes between clearly legitimate traffic, uncertain cases, and high-risk automated behavior.
- Browser capability and fingerprint analysis (Canvas, WebGL, Audio, and feature consistency checks) helps detect automation that mimics real browsers.
- Honeypot detection mechanisms identify automated systems interacting with hidden elements that normal users never see.
- Configurable enforcement thresholds allow you to define when traffic should be allowed, challenged, or blocked.
- Traffic categories include Verified Bot, Bot, Bad Bot, and AI-related automated traffic.
- Transparent decision logs show why a visitor was classified or restricted.
AI Bot Control (Traffic Identification & Control)
- AI traffic identification by provider name. Detects automated traffic associated with well-known AI and technology platforms (such as OpenAI, Meta, Google, and others) based on network signals.
- Granular AI access control. Apply custom policies (allow, challenge, restrict, or block) based on detected AI provider identity.
- Provider-based visibility. See which AI platforms are accessing your site directly in the live traffic dashboard.
🌍 Country Control (GEO-IP Access Rules)
- Built-in country detection
- Block List or Allow List specific countries
- Real-time country visibility in the dashboard
- No external API required
☁️ Challenge & CAPTCHA
- Adaptive verification for borderline traffic
- Optional “Under Attack” mode
- Reduced false positives through challenge-based validation
- Analytics shows tool effectiveness: passes and failures.
📊 Analytics (Live Traffic & Security Feed)
- Real-time dashboard showing visitor classification and current security activity
- Live activity feed displaying incoming traffic with bot score and country
- Challenge & CAPTCHA performance metrics including challenge rate and pass rate for verification accuracy
- Detailed enforcement history explaining when and why a specific IP address was blocked or restricted
- Historical analytics with hourly, daily, and weekly traffic trends
- Country distribution charts visualizing geographic traffic patterns
This visibility allows site owners to understand how traffic is being classified and managed, rather than relying on an opaque security system.
🛡️ Additional Security Features
Block reason tracking shows exactly why visitors were blocked
IP whitelist support ensures trusted IPs never get blocked (critical for testing and administration)
Rate limiting and burst protection prevents overwhelming your server with requests
Temporary IP bans with automatic expiration; whitelisted IPs always bypass bans
Classification override allows banning all bots or only malicious bots
How does Baskerville protect sites from bots?
Baskerville uses a layered traffic classification approach. Each visitor receives a dynamic risk score (0–100) based on browser environment and technical characteristics. Depending on that score, the plugin can allow access, apply a verification challenge, or restrict automated traffic.
It combines browser fingerprinting, browser capability checks, and optional challenge verification for uncertain cases.
Why might I want to manage AI crawler access?
Some automated systems retrieve website content at scale. Baskerville allows site owners to monitor and manage this type of traffic according to their own policies.
The plugin can identify automated traffic associated with known AI platforms and apply custom rules (allow, challenge, or restrict) based on configuration.
What makes Baskerville different from other security plugins?
Many security plugins rely primarily on static blocklists. Baskerville focuses on browser fingerprinting, traffic classification and graduated responses instead of simple allow/deny rules.
It provides transparency through live activity feeds and detailed decision logs, allowing site owners to understand how traffic is being handled.
Is Baskerville free?
Baskerville is open source developed by eQualitie, a Canadian non-profit organization focused on privacy, security, and open technologies.
The core plugin is available free of charge. Additional optional services or future enhancements may be introduced separately, but the plugin itself does not require a paid subscription to operate.
How can Baskerville reduce hosting costs?
By filtering abusive or high-volume automated traffic before it consumes server resources, Baskerville may reduce unnecessary load. This can help prevent resource spikes caused by bots or traffic surges.
Actual impact depends on your hosting environment and traffic profile.
Will Baskerville slow down my website?
Baskerville is designed to have minimal performance impact. With caching enabled, overhead is typically very low. Allow-listed IP addresses bypass enforcement checks.
Exact performance impact depends on server configuration and logging mode.
How does the scoring system work?
Each visitor receives a dynamic score between 0 and 100:
- 0–39: Low-risk traffic. Allowed
- 40–70: Uncertain. May receive a challenge
- 71–100: High-risk automated behavior. Restricted based on configuration
Thresholds are configurable.
What are honeypot traps?
Honeypot mechanisms are hidden elements embedded in page markup that normal users never interact with. Automated systems that trigger these elements may be classified as bots.
Does Baskerville detect legitimate bots like Google?
Yes. Baskerville distinguishes between different categories of automated traffic, including verified search engines and monitoring services.
Verified bots are allowed by default, while suspicious or abusive automation can be restricted.
Can I customize the bot detection thresholds?
Yes. You can configure:
- Bot score challenge range
- Instant ban threshold
- Whether to restrict all bots or only high-risk traffic
This allows you to balance strictness and usability.
What challenge and CAPTCHA options does Baskerville support?
Baskerville includes two challenge mechanisms for uncertain traffic:
Altcha is a built-in, open-sourced privacy-friendly proof-of-work challenge that works out of the box with no configuration or third-party account required.
Cloudflare Turnstile is an optional alternative for sites already using Cloudflare. It requires a free Cloudflare account and API keys.
Both options challenge borderline traffic instead of blocking it outright, reducing false positives while keeping real visitors unaffected.
Does Baskerville support country blocking?
Yes. You can configure:
- Allow All Countries (default)
- Block specific countries
- Allow only specific countries
Country detection is built in and works out of the box without requiring external APIs.
For improved geographic accuracy, site owners may optionally upload their own publicly available GeoIP database (such as a MaxMind GeoLite2 database). This step is entirely optional and not required for the plugin to function.
Does Baskerville block a human visitor if they use VPN?
Baskerville does not automatically block VPN users. However, if country restrictions are enabled, some visitors may receive a verification challenge depending on configuration.
How do I know if Baskerville is working?
You can monitor:
- The live activity feed
- Historical traffic analytics
- Challenge metrics like pass rate
- The proportion of automated versus human traffic over time
These tools provide visibility into traffic classification, enforcement activity, and how much of your incoming traffic is automated.
What logging options are available?
You can choose between:
- File logging (lower overhead)
- Database logging (faster analytics access, higher overhead)
- Minimal logging mode
What happens during an attack?
You can enable “Under Attack” mode, which challenges all incoming traffic temporarily. Once the situation stabilizes, normal operation can be restored.
Is there a way to quickly disable protection if something goes wrong?
Yes. Baskerville includes a global Master Switch that allows you to instantly disable all traffic enforcement from the WordPress dashboard.
This is useful if you are troubleshooting conflicts, testing configurations, or responding to unexpected behavior. When disabled, Baskerville stops blocking or challenging visitors while keeping your settings intact.
The Master Switch was designed as an operational safety feature to ensure that site owners can immediately restore normal access without technical intervention.
Can I test my site’s performance without getting blocked?
For normal browser testing, you are unlikely to be blocked — Baskerville targets automated traffic patterns, not regular browsing.
However, if you plan to run load tests or automated crawlers (Apache Bench, wget, Screaming Frog, etc.), add your IP to the whitelist first (Baskerville → Settings → Allowed IPs). These tools lack browser characteristics (cookies, JavaScript) and will trigger burst protection within seconds. Whitelisted IPs bypass all security checks.
What if I get locked out of my site?
The WordPress admin area (/wp-admin/ and /wp-login.php) is always exempt from all Baskerville blocking rules — you can always log into your dashboard, even if your IP has been temporarily banned on the frontend.
From the dashboard you can:
- Add your IP to the whitelist
- Disable blocking via the Master Switch
- Adjust thresholds or disable specific rules
Additionally, all IP bans are temporary (default: 10 minutes) and expire automatically. As a precaution, always add your IP address to the whitelist before enabling strict blocking rules.
If you cannot access your dashboard for any other reason (e.g., unrelated PHP error):
- Connect to your server via FTP or SSH
- Navigate to /wp-content/plugins/
- Rename the baskerville-ai-security folder (this deactivates the plugin)
- Log into WordPress and fix the issue
- Restore the original folder name
Can I use Baskerville with other security plugins?
Yes, but avoid running multiple traffic-filtering firewalls simultaneously, as this may cause conflicts or redundant processing.
Contacts and Support
For issues and feature requests, please visit our support page here https://wordpress.org/support/plugin/baskerville-ai-security/ or email us at wp@equalitie.org
For general questions, please use a contact form on our website https://baskerville.ai/wp-plugin/
Baskerville AI Security is open-source software licensed under the GNU General Public License v3.0 (GPLv3). You are free to use, modify, and distribute the plugin under the terms of the GPLv3 license.
The plugin is available on the official WordPress.org plugin directory and follows WordPress.org plugin licensing requirements.
Baskerville AI
Baskerville AI is an optional cloud extension for the Baskerville WordPress plugin. Once enabled, your site securely sends aggregated traffic statistics to Baskerville Cloud, where an AI
agent analyses patterns across sessions, countries, user agents, and bot categories — and returns concrete actions that the plugin applies automatically: block a country, restrict an ASN,
challenge a fingerprint group, or flag a specific user agent.
For example:
“Over the last 24 hours, 340 requests came from GPTBot with mismatched IP ranges — likely spoofed. Traffic from Germany spiked 4x at 3am, concentrated on a single ASN.”
The agent blocks that ASN and tightens the challenge threshold for the affected country — automatically, while you sleep.
No raw visitor data or personal information is sent — only aggregated traffic statistics.
AI Watchdog
Every night, the AI Watchdog automatically analyses the previous day’s traffic and generates a summary report directly in your WordPress dashboard. No manual queries required — by the time
you open your admin panel in the morning, the report is already there.
The report covers what happened overnight: how much traffic was automated, which bot categories were most active, whether any unusual patterns or spikes occurred, and which countries and
providers dominated the traffic.
The Watchdog runs silently in the background and requires no configuration. It is part of the Baskerville AI & Cloud subscription.
Ask AI About Your Traffic
The AI query interface lets you ask direct questions about your site’s traffic and get specific answers based on your own data. Select a time period — last 7, 30, or 90 days — and ask
anything.
You can type your own question or pick from suggested prompts:
- Any incidents recently?
- What AI crawls my site?
- Any unusual patterns?
- Any AI spoofers?
- Top countries today?
- Human vs bot ratio this week?
- Am I under attack?
- What happened last night?
- Why do I need this plugin?
The AI has full access to your traffic history, bot classifications, country breakdowns, and incident log — and answers based on your site’s actual data, not generic advice.
You can also ask about plugin configuration — how to enable country blocking, what the challenge threshold means, when to use Under Attack mode, or how to allowlist a specific bot. Instead of searching through documentation, ask in plain English and get a direct answer based on your current setup.
For example: “How do I block a country?” or “What does the bot score threshold do?” — and get step-by-step instructions without leaving the dashboard.