Baskerville WordPress Plugin

  • Overview
  • Features
  • FAQ
  • Screenshots
  • License
Get Plugin

Websites constantly receive automated traffic from various bots and AI agents — some of it harmless, some annoying or abusive. Benign and useful bots help search engines index your website and improve your various rankings. Malicious bots can evaluate your website’s vulnerabilities, attempting login attacks, overloading server resources and mimic real users in ways that are difficult to detect. A growing proportion of automated traffic is not scraping your website’s content in order to train some large language model (AI).

Baskerville is a WordPress plugin designed to help you monitor, classify, and control automated traffic. It runs in the background giving you the visibility and tools to manage how bots and suspicious visitors interact with your site.

What Does Baskerville Do?

Baskerville watches how visitors behave and assigns each one a risk score based on their activity and request patterns. Based on that score, it can:

  • Allow legitimate visitors and search engines through without interruption
  • Challenge suspicious traffic
  • Restrict or block abusive activity before it causes damage to your website

This results in less spam and fewer attacks, and has no impact on your real visitors.

Baskerville Helps Protect Against:

  • Brute-force login attempts
  • Automated spam on forms and comments
  • Content scraping and large-scale data extraction
  • Suspicious automated behavior designed to mimic browsers
  • Traffic surges that resemble DDoS-style abuse

Why Baskerville Is Different

Many security plugins rely primarily on static IP block-lists or rules and bad actors know it. Baskerville focuses on traffic behavior and classification. Instead of blocking everything unknown, it evaluates visitor activity and applies graduated responses (allow, challenge, or block). The dynamic score system (0–100) allows more nuanced decisions than simple “allow or deny” rules.

Baskerville is Open Source and Built for Practical Use

Baskerville is designed to work out of the box. After activation, it immediately begins monitoring traffic, no complicated setup required. When you’re ready, use configuration options to fine-tune thresholds, country controls, and verification behavior.

The plugin is open source and actively maintained. Future optional features may expand its capabilities, but the core protection remains available without complex setup.

Bot Control (Detection & Traffic Classification)

  • Probabilistic scoring system assigns each visitor a dynamic risk score (0–100) based on behavioral and technical signals.
  • Graduated scoring model distinguishes between clearly legitimate traffic, uncertain cases, and high-risk automated behavior.
  • Browser capability and fingerprint analysis (Canvas, WebGL, Audio, and feature consistency checks) helps detect automation that mimics real browsers.
  • Honeypot detection mechanisms identify automated systems interacting with hidden elements that normal users never see.
  • Configurable enforcement thresholds allow you to define when traffic should be allowed, challenged, or blocked.
  • Traffic categories include Verified Bot, Bot, Bad Bot, and AI-related automated traffic.
  • Transparent decision logs show why a visitor was classified or restricted.

AI Bot Control (Traffic Identification & Control)

  • AI traffic identification by provider name. Detects automated traffic associated with well-known AI and technology platforms (such as OpenAI, Meta, Google, and others) based on network and behavioral signals.
  • Granular AI access control. Apply custom policies (allow, challenge, restrict, or block) based on detected AI provider identity.
  • Provider-based visibility. See which AI platforms are accessing your site directly in the live traffic dashboard.

🌍 Country Control (GEO-IP Access Rules)

  • Built-in country detection
  • Block List or Allow List specific countries
  • Real-time country visibility in the dashboard
  • No external API required

☁️ Turnstile (Cloudflare)

  • Adaptive verification for borderline traffic
  • Optional “Under Attack” mode
  • Reduced false positives through challenge-based validation
  • Analytics shows tool effectiveness: passes and failures.

📊 Analytics (Live Traffic & Security Feed)

  • Real-time dashboard showing visitor classification and current security activity 
  • Live activity feed displaying incoming traffic with bot score and country 
  • Turnstile performance metrics including challenge rate and pass rate for verification accuracy 
  • Detailed enforcement history explaining when and why a specific IP address was blocked or restricted 
  • Historical analytics with hourly, daily, and weekly traffic trends 
  • Country distribution charts visualizing geographic traffic patterns 

This visibility allows site owners to understand how traffic is being classified and managed, rather than relying on an opaque security system.

🛡️ Additional Security Features

Block reason tracking shows exactly why visitors were blocked

IP whitelist support ensures trusted IPs never get blocked (critical for testing and administration)

Rate limiting and burst protection prevents overwhelming your server with requests

Temporary IP bans with automatic expiration; whitelisted IPs always bypass bans

Classification override allows banning all bots or only malicious bots

How does Baskerville protect sites from bots?

Baskerville uses a layered traffic classification approach. Each visitor receives a dynamic risk score (0–100) based on behavioral signals and technical characteristics. Depending on that score, the plugin can allow access, apply a verification challenge, or restrict automated traffic.

It combines behavior analysis, browser capability checks, and optional Cloudflare Turnstile verification for uncertain cases.

Why might I want to manage AI crawler access?

Some automated systems retrieve website content at scale. Baskerville allows site owners to monitor and manage this type of traffic according to their own policies.

The plugin can identify automated traffic associated with known AI platforms and apply custom rules (allow, challenge, or restrict) based on configuration.

What makes Baskerville different from other security plugins?

Many security plugins rely primarily on static blocklists. Baskerville focuses on behavioral classification and graduated responses instead of simple allow/deny rules.

It provides transparency through live activity feeds and detailed decision logs, allowing site owners to understand how traffic is being handled. 

Is Baskerville free?

Baskerville is open source developed by eQualitie, a Canadian non-profit organization focused on privacy, security, and open technologies.

The core plugin is available free of charge. Additional optional services or future enhancements may be introduced separately, but the plugin itself does not require a paid subscription to operate.

How can Baskerville reduce hosting costs?

By filtering abusive or high-volume automated traffic before it consumes server resources, Baskerville may reduce unnecessary load. This can help prevent resource spikes caused by bots or traffic surges.

Actual impact depends on your hosting environment and traffic profile.

Will Baskerville slow down my website?

Baskerville is designed to have minimal performance impact. With caching enabled, overhead is typically very low. Allow-listed IP addresses bypass enforcement checks.

Exact performance impact depends on server configuration and logging mode.

How does the scoring system work?

Each visitor receives a dynamic score between 0 and 100:

  • 0–39: Low-risk traffic. Allowed
  • 40–70: Uncertain. May receive a Turnstile challenge
  • 71–100: High-risk automated behavior. Restricted based on configuration

Thresholds are configurable.

What are honeypot traps?

Honeypot mechanisms are hidden elements embedded in page markup that normal users never interact with. Automated systems that trigger these elements may be classified as bots.

Does Baskerville detect legitimate bots like Google?

Yes. Baskerville distinguishes between different categories of automated traffic, including verified search engines and monitoring services.

Verified bots are allowed by default, while suspicious or abusive automation can be restricted.

Can I customize the bot detection thresholds?

Yes. You can configure:

  • Bot score challenge range
  • Instant ban threshold
  • Whether to restrict all bots or only high-risk traffic

This allows you to balance strictness and usability.

What is Cloudflare Turnstile and why should I use it?

Cloudflare Turnstile is an optional verification mechanism that challenges uncertain traffic. Instead of blocking borderline cases outright, Turnstile provides an additional validation step to reduce false positives.

Does Baskerville support country blocking?

Yes. You can configure:

  • Allow All Countries (default) 
  • Block specific countries 
  • Allow only specific countries 

Country detection is built in and works out of the box without requiring external APIs.

For improved geographic accuracy, site owners may optionally upload their own publicly available GeoIP database (such as a MaxMind GeoLite2 database). This step is entirely optional and not required for the plugin to function.

Does Baskerville block a human visitor if they use VPN?

Baskerville does not automatically block VPN users. However, if country restrictions are enabled, some visitors may receive a verification challenge depending on configuration.

How do I know if Baskerville is working?

You can monitor:

  • The live activity feed 
  • Historical traffic analytics 
  • Turnstile challenge metrics  like pass rate
  • The proportion of automated versus human traffic over time 

These tools provide visibility into traffic classification, enforcement activity, and how much of your incoming traffic is automated.

What logging options are available?

You can choose between:

  • File logging (lower overhead)
  • Database logging (faster analytics access, higher overhead)
  • Minimal logging mode

What happens during an attack?

You can enable “Under Attack” mode, which challenges all incoming traffic temporarily. Once the situation stabilizes, normal operation can be restored.

Is there a way to quickly disable protection if something goes wrong?

Yes. Baskerville includes a global Master Switch that allows you to instantly disable all traffic enforcement from the WordPress dashboard.

This is useful if you are troubleshooting conflicts, testing configurations, or responding to unexpected behavior. When disabled, Baskerville stops blocking or challenging visitors while keeping your settings intact.

The Master Switch was designed as an operational safety feature to ensure that site owners can immediately restore normal access without technical intervention.

Can I test my site’s performance without getting blocked?

For normal browser testing, you are unlikely to be blocked — Baskerville targets automated traffic patterns, not regular browsing.

However, if you plan to run load tests or automated crawlers (Apache Bench, wget, Screaming Frog, etc.), add your IP to the whitelist first (Baskerville → Settings → Allowed IPs). These tools lack browser characteristics (cookies, JavaScript) and will trigger burst protection within seconds. Whitelisted IPs bypass all security checks.

What if I get locked out of my site?

The WordPress admin area (/wp-admin/ and /wp-login.php) is always exempt from all Baskerville blocking rules — you can always log into your dashboard, even if your IP has been temporarily banned on the frontend.

From the dashboard you can:

  • Add your IP to the whitelist
  • Disable blocking via the Master Switch
  • Adjust thresholds or disable specific rules

Additionally, all IP bans are temporary (default: 10 minutes) and expire automatically. As a precaution, always add your IP address to the whitelist before enabling strict blocking rules.

If you cannot access your dashboard for any other reason (e.g., unrelated PHP error):

  1.   Connect to your server via FTP or SSH
  2.   Navigate to /wp-content/plugins/
  3.   Rename the baskerville-ai-security folder (this deactivates the plugin)
  4.   Log into WordPress and fix the issue
  5.   Restore the original folder name

Can I use Baskerville with other security plugins?

Yes, but avoid running multiple traffic-filtering firewalls simultaneously, as this may cause conflicts or redundant processing.

Contacts and Support

For issues and feature requests, please visit our support page here https://wordpress.org/support/plugin/baskerville-ai-security/ or email us at wp@equalitie.org

For general questions, please use a contact form on our website https://baskerville.ai/wp-plugin/ 

Add your content here…

Add your content here…