Baskerville MAIA: Managed AI Access

How It Works

Baskerville monitors visitor behavior and assigns each session a risk score from 0 to 100, based on activity patterns and technical signals. Based on that score, it:

✓

Allow

Passes legitimate visitors and search engines through without interruption.

Challenge

Applies a lightweight verification step to borderline or uncertain traffic.

Block

Restricts high-risk automated behavior before it reaches your server.

Real visitors notice nothing. Bots and scrapers get stopped.

Baskerville Helps Protect Against:

Brute-force login attempts

Automated form and comment spam

Content scraping and AI data harvesting

Browser-mimicking bots designed to evade detection

Traffic surges that overwhelm your server

Why Baskerville Is Different

Most security plugins rely on static IP blocklists. Sophisticated bots know this and route around them.

Baskerville classifies traffic by behavior, not origin. Instead of a binary allow/deny decision, it applies graduated responses — allow, challenge, or block — based on a dynamic risk score. This means fewer false positives (legitimate users don't get caught in the crossfire) and stronger coverage against novel attack patterns that no blocklist has seen yet.

The scoring system runs on a 0–100 scale, giving you the flexibility to tune how strict or permissive enforcement should be.

Open Source and Built for Practical Use

Baskerville works out of the box. Activate it and it starts monitoring traffic immediately — no API keys, no external services, no complicated setup. When you're ready, fine-tune thresholds, country rules, and verification behavior from the settings panel.

Features

Bot Control — Detection & Traffic Classification

Probabilistic scoringAssigns each visitor a dynamic risk score (0–100) based on behavioral and technical signals.
Graduated responsesDistinguishes clearly legitimate traffic, uncertain cases, and high-risk automated behavior.
Browser fingerprint analysisCanvas, WebGL, Audio, and feature-consistency checks detect automation that mimics real browsers.
Honeypot detectionIdentifies bots that interact with hidden elements real users never see.
Configurable thresholdsDefine exactly when traffic should be allowed, challenged, or blocked.
Traffic categoriesVerified Bot, Bot, Bad Bot, and AI-related traffic are classified separately.
Transparent decision logsSee exactly why each visitor was classified or restricted.

AI Bot Control — Traffic Identification & Control

AI traffic identificationDetects automated traffic from OpenAI, Meta, Google, and others based on network and behavioral signals.
Per-provider access controlApply custom policies (allow, challenge, restrict, or block) per AI provider.
Live visibilitySee which AI platforms are accessing your site in the real-time traffic dashboard.

Country Control — Geo-IP Access Rules

Built-in country detectionNo external API required.
Block or allow specific countriesBlocklist or allowlist by country code.
Real-time visibilityCountry breakdown in the live dashboard.

Turnstile — Cloudflare Verification (Optional)

Adaptive verificationLightweight challenge for borderline traffic — passes humans, stops bots.
"Under Attack" modeChallenge all incoming traffic during high-threat periods.
Reduced false positivesChallenge-based validation before blocking.
AnalyticsPass rate and failure rate metrics.

Analytics — Live Traffic & Security Feed

Real-time dashboardVisitor classification and current security activity.
Live activity feedIncoming traffic with bot score and country.
Verification metricsChallenge rate and pass rate for Turnstile accuracy.
Enforcement historyWhen and why a specific IP was blocked or restricted.
Historical trendsHourly, daily, and weekly traffic data.
Country distribution chartsGeographic traffic patterns at a glance.

This visibility lets you understand how traffic is being classified and managed, rather than relying on an opaque security black box.

Additional Security Features

Block reason trackingShows exactly why a visitor was blocked.
IP allowlistTrusted IPs are never blocked — essential for testing and administration.
Rate limiting and burst protectionPrevents requests from overwhelming your server.
Temporary IP bansAuto-expire after a configurable period; allowlisted IPs always bypass.
Classification overrideChoose to restrict all bots, or only high-risk ones.

Frequently Asked Questions

How does Baskerville protect sites from bots?

Each visitor receives a dynamic risk score (0–100) based on behavioral signals and technical characteristics. Depending on that score, the plugin allows access, issues a verification challenge, or restricts automated traffic. It combines behavior analysis, browser capability checks, and optional Cloudflare Turnstile verification.

Why might I want to manage AI crawler access?

AI systems increasingly retrieve website content at scale to train models. Baskerville lets you monitor and control this traffic according to your own policies — allowing trusted crawlers, challenging unknown ones, or blocking specific providers entirely.

What makes Baskerville different from other security plugins?

Most security plugins rely on static blocklists. Baskerville classifies traffic by behavior and applies graduated responses rather than simple allow/deny rules. It also provides full transparency through live activity feeds and detailed decision logs.

Is Baskerville free?

Yes. Baskerville is free and open source, developed by eQualitie, a Canadian non-profit focused on privacy, security, and open technologies.

How does the scoring system work?

Score	Classification	Action
0–39	Low risk	Allowed through
40–70	Uncertain	May receive Turnstile challenge
71–100	High-risk automated behavior	Restricted based on configuration

All thresholds are configurable.

Will Baskerville slow down my website?

No. Baskerville is designed for minimal performance overhead. With caching enabled, the impact is negligible for most sites. Allowlisted IPs bypass enforcement checks entirely.

What if I get locked out of my site?

The WordPress admin area (/wp-admin/ and /wp-login.php) is always exempt from Baskerville rules — you can always access your dashboard. All IP bans expire automatically (default: 10 minutes). If you can't reach the dashboard for an unrelated reason:

Connect via FTP or SSH
Navigate to /wp-content/plugins/
Rename the baskerville-ai-security folder to deactivate the plugin
Log in, fix the issue, then restore the folder name

Does Baskerville detect legitimate bots like Googlebot?

Yes. Baskerville distinguishes between verified crawlers (search engines, monitoring services) and suspicious automation. Verified bots are allowed by default.

Is there a quick way to disable protection if something goes wrong?

Yes. The Master Switch in the WordPress dashboard instantly disables all enforcement — blocking and challenges stop immediately, but your settings are preserved.

Can I use Baskerville with other security plugins?

Yes, but avoid running multiple traffic-filtering firewalls at the same time — this can cause conflicts or redundant processing.

Screenshots

Live views from the Baskerville dashboard showing traffic classification, enforcement activity, and analytics.