Baskerville AI Security
| 开发者 |
equalitie
burdianov mazhurin |
|---|---|
| 更新时间 | 2026年10月29日 23:09 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPL v3 |
详情介绍:
Baskerville is a comprehensive WordPress security plugin that protects your site from malicious bots, AI crawlers, and unwanted traffic using multiple detection methods.
Key Features:
- AI Bot Detection - Browser fingerprint scoring (Canvas, WebGL, Audio) assigns every visitor a risk score 0–100
- AI Spoofer Detection - Catches bots faking legitimate AI crawler identities (GPTBot, ClaudeBot, etc.) by verifying IP ranges against published ASN data
- GeoIP Access Control - Block or allow traffic by country, built-in GeoIP with no external API required
- CAPTCHA Challenge - Altcha (built-in, no account needed) or Cloudflare Turnstile (optional)
- Per-Provider AI Bot Rules - Allow, challenge, or block by AI company (OpenAI, Meta, Google, and others)
- Honeypot Detection - Hidden links to catch automated crawlers
- Live Traffic Feed - Every request, score, classification, and decision in real time
- High-Risk Page Protection - Login, registration, and comment pages hardened automatically
- Under Attack Mode - Emergency mode to challenge all visitors
- IP Whitelist - Trusted IPs always bypass all enforcement
- Near-Zero Latency - Firewall runs from local cache, no outbound calls on request path. On cached pages: zero PHP overhead per page serve, plus one fingerprint POST per new visitor per 6h
- AI Cloud Analysis (optional, paid) - Nightly watchdog report and natural language query interface powered by LLM
- 0-39: Likely human (allowed)
- 40-70: Borderline (optional Turnstile challenge)
- 71-100: Likely bot (blocked)
- Zero PHP overhead per cached page serve
- One fingerprint POST per new visitor per 6h (full WP bootstrap — this is the real cost on cached sites)
- APCu / Redis / file-based caching for GeoIP lookups and ban entries
- Compatible with all major caching plugins
安装:
- Upload the plugin files to
/wp-content/plugins/baskerville/or install via WordPress admin - Activate the plugin through the 'Plugins' menu
- Go to Settings > Baskerville to configure
- Install MaxMind GeoLite2 database for GeoIP features (one-click installer in Settings)
- (Optional) Configure Cloudflare Turnstile keys for CAPTCHA challenges
常见问题:
How do I set up GeoIP blocking?
Go to Settings > Baskerville > GeoIP, install the MaxMind database, then configure your country whitelist or blacklist.
How does Turnstile work?
Visitors with borderline bot scores (default 40-70) are shown a Cloudflare Turnstile challenge. If they pass, they're allowed through. This catches bots while minimizing friction for real users.
What is Under Attack Mode?
Emergency mode that shows Turnstile challenge to ALL visitors. Use this when your site is under active attack.
Will this slow down my site?
With page caching enabled, each cached page serve has zero PHP overhead. The real cost is one fingerprint POST per new visitor every 6 hours — this is a full WordPress bootstrap used for bot scoring. Without page caching, expect ~30-50ms overhead per request.
更新日志:
1.0.6
- Security: removed trust of spoofable X-Country-Code and CF-IPCountry headers — only server-set GEOIP2_COUNTRY_CODE, GEOIP_COUNTRY_CODE and X-Deflect-Country-Code are trusted
- Security: AJAX live feed and live stats endpoints now require manage_options capability and nonce
- Security: honeypot no longer bans verified crawlers (Googlebot, Bingbot) — verify_crawler_ip() called before ban
- Security: honeypot and firewall 403 responses now send X-Accel-Expires: 0 to prevent nginx caching
- Security: ban check now runs before challenge URL bypass to close DoS amplification vector
- Security: challenge URL bypass uses exact GET key matching instead of substring matching in query string
- Security: is_api_request() path matching strips query string before comparison
- Performance: fingerprint POST retries with fresh nonce on 403 to handle nonce tick boundary edge case
- Performance: live feed and live stats results cached for 30s server-side; JS poll interval increased to 60s
- Performance: snapshot aggregation skipped when no traffic in current 5-minute window
- Performance: stats cleanup uses batched DELETE (1000 rows/batch) instead of unbounded single query
- Performance: AI bot IP ranges fetched via WP-Cron (hourly) instead of on the request path
- Performance: HTTP/1.x score penalty skipped when request comes through a reverse proxy
- Performance: removed jQuery dependency from frontend (was loaded for a no-op console.log)
- Improvement: remote-controlled blocking (cloud action enforcement) is now a configurable opt-in setting (default: on)
- Improvement: GeoIP download notice shows inline button and checks for header-based GeoIP sources before showing
- Improvement: Live Traffic Feed shows disclaimer that counts reflect PHP-reached requests only
- Improvement: cache backend status visible in Settings (APCu / Redis / file fallback)
- Improvement: CF-IPCountry header support restored as an opt-in setting — enable in Country Control when the site is behind Cloudflare (orange-cloud); disabled by default to prevent spoofing on non-Cloudflare stacks
- Improvement: CDN auto-detection on activation — Cloudflare and Deflect CDN are detected from request headers and trust settings configured automatically; admin notice confirms what was detected
- AI Cloud integration: nightly AI Watchdog report in WordPress dashboard
- AI query interface: ask questions about your traffic in plain English
- Cloud action enforcement: LLM agent can now block by country and user agent automatically
- Token usage tracking: see monthly AI token consumption in admin panel
- Quick question chips in AI panel for one-click queries
- Fix: wpsec_log() was undefined causing silent PHP fatal error in WP Cron, preventing nightly watchdog from running
- Fix: double watchdog job submission on first run after midnight
- Altcha PoW challenge support — self-hosted, privacy-friendly, works out of the box
- Altcha widget on login, registration and comment forms
- Login form protection stats in Analytics dashboard
- AI crawlers IP verification via published IP ranges and reverse DNS
- AI spoofers detection — crawlers pretending to be legitimate AI bots with mismatched IP
- Expanded AI company coverage
- Fix: Meta crawlers (meta-externalagent) incorrectly flagged as spoofers on IPs without PTR records
- Fix: Master switch OFF now correctly disables all blocking including honeypot and form challenges
- Deflect GEO IP support
- JS burst counter fix (static files excluded)
- Replaced hardcoded Ajax/REST paths with wp_doing_ajax(), REST_REQUEST and rest_get_url_prefix().
- Replaced direct require_once of class-pclzip.php with WordPress unzip_file() API.
- Replaced WP_CONTENT_DIR usage with wp_upload_dir() for GeoIP database paths.
- Changed REST /fp permission_callback to __return_true (intentionally public endpoint).
- Made nonce validation mandatory in REST fingerprint handler (fail-early on missing nonce).
- Added nonce and current_user_can('manage_options') checks to debug widget toggle.
- Removed DONOTCACHEPAGE global constant definition.
- Removed unsanitized $_COOKIE processing from debug headers; now checks only specific plugin cookies.
- Documented MaxMind GitHub library downloads in readme External Services section.
- Removed external URL from test User-Agent strings.
- Added support for the Deflect GeoIP database.
- Made all hardcoded text fully translatable.
- Renamed the plugin to Baskerville AI Security.
- Moved all inline scripts and styles to proper wp_enqueue_script() / wp_enqueue_style() usage.
- Updated Chart.js to v4.5.1.