Automated Detection, Behavior, and Scoring

Automated detection examines a visitor message for configured phrases, regular expressions, code-like input, unusual characters, rapid sending, and consecutive repetition. Every match becomes a separate flag with a severity value. SmartSite adds those values together, compares the total with the threshold, and then decides whether the message may continue to the AI.

The score is not a probability and it does not describe how dangerous a person is. It is simply arithmetic based on the rules that matched this one message. The practical goal is to make suspicious combinations easy to review or block without preventing ordinary visitors from asking legitimate technical or sensitive questions.

How a message moves through detection

Before automated scoring runs, the wider security system checks whitelists, blocked IP addresses, rate limits, message length, and blocked words. Whitelisted tokens or IP addresses bypass all security checks. An IP block, rate limit, oversized message, or blocked-word action set to Block can reject a request immediately without waiting for the automated threshold.

If the message reaches automated detection, the decision follows this sequence:

1. Each enabled detector examines the same message.
2. Every matching phrase, expression, abuse rule, or behavior can create its own flag.
3. The severity assigned to that detector supplies the flag’s points.
4. SmartSite adds those points to any non-blocking blocked-word score already collected.
5. The total is compared with the configured threshold using greater than or equal to.
6. Block rejects only when the total reaches the threshold. Flag and Warn allow the message and record it for review.

A threshold does not decide whether a detection is logged

A detected message below the threshold is still allowed and flagged. Raising the threshold does not make those records disappear from Flagged Conversations. It mainly changes when the Block action denies a message.

Find the scoring controls

WordPress locationWordPress Dashboard → AI Website Chat → Security → Configuration → Auto-Flag Detection

You need an administrator account that can change plugin settings and a safe test period where synthetic messages will not be confused with real abuse. Use a private browser session and avoid testing against production email, webhook, or other action tools.

What the four severity levels mean

The numeric values are fixed in the security implementation. You do not edit “Medium” from 3 to another number. Instead, each detector has a Severity selector where you choose which fixed level its flags should receive.

Severity levels and fixed scores

Severity	Score per flag	How to interpret it
Low	1 point	A weak or minor signal. No automated detector uses Low by default, but an administrator can assign it to a detection category.
Medium	3 points	The default for custom content patterns and behavioral detection. Several Medium flags can add up to the threshold.
High	5 points	The default for abuse and code-injection detection. Two separate High flags reach the default threshold of 10.
Critical	10 points	The default for jailbreak detection. One Critical flag reaches the default threshold on its own.

Severity describes how strongly one matching rule contributes to the total. It is not a confidence percentage. A Medium match does not mean “three percent suspicious,” and a Critical match does not prove that the visitor is malicious.

The severity shown for the overall result is the highest individual severity among its flags, while the score is the sum of all flag points. A result can therefore display High severity with a total above 5 when several High or lower-severity flags were added together.

A score is the sum of every flag

The important unit is a flag, not merely a detector category. If two jailbreak patterns match the same message, each match creates a Critical flag. If abuse detection finds both excessive special characters and a code-injection pattern, it can create two High flags. Rapid and repeated behavior can also trigger together.

Worked scoring examples using the default severity assignments

Example message outcome	Flags added	Total score	Result with threshold 10
One jailbreak phrase	Critical	10	Reaches threshold 10. Flag/Warn allows and records it; Block rejects it.
One code-injection pattern	High	5	Below threshold 10, but still allowed and recorded as flagged.
Code-injection + one content pattern	High + Medium	5 + 3 = 8	Still below 10 and still flagged. It is not blocked when the automated action is Block.
Code-injection + rapid messages + repeated message	High + Medium + Medium	5 + 3 + 3 = 11	Crosses threshold 10. The configured automated action is applied.
Two separate jailbreak patterns match the same message	Critical + Critical	10 + 10 = 20	Each matching pattern creates its own flag, so both scores are added.
Special-character abuse + code-injection pattern	High + High	5 + 5 = 10	Abuse detection can create two flags for one message and reach the default threshold.
Blocked word + one abuse signal	High + High	5 + 5 = 10	A non-blocking blocked-word match contributes to the same total before automated detection is evaluated.

Blocked words can contribute to this total

When Blocked Words is enabled and its own action is Flag or Warn, a match adds one fixed High flag worth 5 points. Automated detections are then added to the same total. If the blocked-word action itself is Block, the request is denied immediately instead.

What the threshold changes

The threshold is the minimum total required for the selected automated action to be evaluated: total score ≥ threshold.

Lower thresholds react to fewer or weaker signals. Higher thresholds require more points to accumulate. That sounds simple, but the effect depends on the selected action.

What happens below and at the threshold

Automated action	Below threshold with at least one flag	At or above threshold	Important detail
Flag	Allowed and marked for review	Allowed and marked for review	This is the default. The threshold does not prevent lower-scoring detections from appearing as flagged.
Warn	Allowed and marked for review	Allowed and marked for review	The current runtime behaves like Flag; it does not return a separate warning to the visitor.
Block	Allowed, but still marked for review	Rejected with the configured block message	This is where the threshold materially changes the visitor outcome.

Because Flag and Warn already mark lower-scoring detections for review, changing the threshold has little visible effect with either of those actions. The threshold is most consequential with Block, where it separates an allowed-but-flagged message from a rejected one.

Choose a threshold you can explain

The default threshold is 10 and the accepted range is 1–100. Choose a value by listing the combinations you want to cross it. Do not pick a lower number simply because it sounds “more secure.”

Example thresholds with the default severity scores

Threshold	Examples that reach it	Operational meaning when action is Block
5	One High flag; two Medium flags total 6	Very sensitive. With Block selected, an ordinary technical false positive can be denied after a single High detection.
8	High + Medium; three Medium flags total 9	Useful only after patterns have been tested carefully. It reacts to combinations that remain below the default.
10	One Critical; two High; High + two Medium	Default. A single High or Medium detection remains allowed but is still marked for review.
15	Critical + High; three High flags	More tolerant when Block is selected. A lone Critical jailbreak match is allowed and flagged because 10 is below 15.
20	Two Critical flags; four High flags	Very tolerant. It reduces automated blocking, but it does not stop detected messages from being recorded as flagged.

For many public sites, threshold 10 with action Flag is a sensible observation period: one Critical match reaches the threshold, while isolated High and Medium detections remain usable and can be reviewed. Moving to Block should be based on false-positive testing, not on the number alone.

Configure the individual detectors

The controls below decide which signals can exist and how many points each signal adds. Changing a category from Medium to High changes every flag produced by that category from 3 points to 5 points.

Automated detection controls

Control	Runtime behavior	How to tune it safely
Enable Automated Detection	Turns pattern/behavior analysis and threshold evaluation on or off. It is enabled by default.	Keep this on when the configured pattern, behavior, severity, and threshold checks should run for messages. Turning it off bypasses this automated evaluation while retaining the saved patterns and scoring configuration.
Automated threshold	Total severity score at which the selected automated action is evaluated. Default 10; UI range 1–100.	Set the total severity score that must be reached before the selected automated action is evaluated. Lowering it makes combinations of weaker signals act sooner; test ordinary questions to avoid flagging legitimate language.
Automated action	Flag and Warn both allow the request and record a flag; Block denies it when the score reaches the threshold. Default Flag.	Choose the outcome applied at or above the threshold. Flag and Warn both allow the request and record flags; choose Block only when a matching request should be denied.
Automated block message	Visitor-facing message returned only when the automated action is Block and the threshold is reached.	Write the visitor notice used only when the action is Block and the score reaches the threshold. Explain that the request cannot be processed without revealing patterns, scores, or instructions that help bypass detection.
Jailbreak detection	Matches the configured jailbreak phrase/pattern list. Enabled by default with Critical severity.	Keep this on to compare messages with the administrator-maintained jailbreak pattern list and add the configured Critical signal when matched. Test the actual phrases because this is pattern matching, not a general guarantee against prompt manipulation.
Jailbreak patterns	One phrase or supported /regex/ pattern per line for prompt-manipulation attempts.	Enter one literal phrase or supported slash-delimited regular expression per line. Use narrow patterns, test expected matches and harmless near-matches, and avoid broad expressions that can classify normal visitor questions as jailbreak attempts.
Abuse / code-injection detection	Checks default abuse/code-like patterns and a high special-character ratio. Enabled by default with High severity.	Keep this on to apply the built-in abuse, code-like, and high-special-character checks with High severity. Review flagged examples because legitimate technical websites may receive normal questions containing code or symbols.
Content flag patterns	Checks the administrator-maintained content pattern list. Enabled by default with Medium severity.	Use this administrator-maintained list for site-specific content signals that should add Medium severity. Add precise terms or patterns and verify them with sanitized tests; this list is separate from blocked words and does not alone block a request.
Behavioral detection	Tracks rapid and repeated messages by visitor token. Enabled by default with Medium severity.	Keep this on to evaluate rapid and repeated activity associated with the visitor token. It adds a Medium signal when configured behavior triggers; it does not establish the visitor’s identity or replace token/IP rate limiting.
Rapid-message count	Number of messages that triggers the rapid behavior signal. Default 5; allowed 2–50.	Set how many messages inside the rapid-message window produce the behavioral signal. A lower count detects bursts sooner but can catch legitimate visitors who send several short corrections or follow-up questions.
Rapid-message window	Seconds used for the rapid-message behavior check. Default 10; allowed 3–120.	Set the number of seconds in which the rapid-message count is evaluated. A longer window makes the same count easier to reach, so test the pace of a normal multi-question conversation before tightening it.
Repeated-message count	Number of matching/repeated messages that triggers the repetition signal. Default 3; allowed 2–20.	Set how many matching or repeated messages produce the repetition signal. Keep it high enough to permit an accidental resend, then test exact repeated input with awareness that the comparison uses the fixed history period.
Repetition history	The implementation compares repetition within a hardcoded five-minute history.	Treat five minutes as a fixed implementation behavior rather than an editable field. When reproducing repetition results, keep tests inside that period or wait until it expires before expecting a fresh history.
Fixed severity scores	Low is 1 point, Medium 3, High 5, and Critical 10. The numbers are fixed; each detection category selects which severity its flags receive.	The four numeric values cannot be edited. To make one category contribute more or less, change that category’s Severity selector; every separate flag it produces will then use the newly selected score.

Pattern matching is literal unless wrapped as a regular expression

Jailbreak and Content Patterns accept one entry per line. A normal entry is matched as a case-insensitive substring, so a short phrase can match inside a longer innocent sentence. An entry beginning and ending with a forward slash is treated as a case-insensitive Unicode regular expression. Invalid expressions are ignored by matching, while overly broad valid expressions can create many false positives.

Abuse detection uses built-in checks. A message longer than 20 characters can receive a High flag when more than 30% of its characters fall outside the implementation’s allowed character set. The separate code-injection check looks for script, JavaScript, event-handler, command-execution, and common SQL-injection patterns.

Understand rapid and repeated behavior

Behavior is tracked by the browser or channel token, not by an authenticated identity. Both behavior signals receive the single severity selected for Behavioral Analysis, but they can appear together and therefore add that score twice.

Behavioral detection timing

Signal	How SmartSite counts it	How a setting change affects it
Rapid messages	Counts messages for the same browser token during the configured transient window. The default signal appears at 5 messages within 10 seconds.	A longer window or lower count makes the signal easier to trigger. Shared identity is not established: the browser token is only a conversation identifier.
Repeated message	Compares a lowercase, trimmed hash with the immediately preceding message for the same token. A different message resets the consecutive count. The history lasts five minutes.	The default signal appears on the third consecutive copy. Waiting beyond five minutes or sending different text starts a new repetition sequence.

Rate limiting is separate. A visitor may trigger behavioral flags without hitting a token or IP rate limit, and a rate limit can block before behavioral scoring runs.

Tune detection without guessing

1. Leave the automated action on Flag while learning what normal visitors trigger.
2. Prepare a small test set: ordinary questions, harmless technical questions, known jailbreak phrases, code-like input, and repeated or rapid messages.
3. Run each test in a controlled browser session and record every flag, severity, and total score shown in Flagged Conversations.
4. Fix broad phrases or regular expressions before changing the threshold. A precise detector is safer than compensating for a noisy detector with a very high threshold.
5. Assign each category the lowest severity that still reflects its importance for this website. The numeric values themselves are fixed; you choose Low, Medium, High, or Critical per category.
6. Choose a threshold from the combinations you actually want to trigger. Calculate the total rather than relying on labels such as “High” or “Critical.”
7. Keep Flag for monitoring, or select Block only after benign near-matches remain usable. Warn currently behaves like Flag.
8. Repeat the complete test set after every pattern, severity, behavior, action, or threshold change.

Prefer changing the noisy rule before raising the threshold

If one harmless phrase produces false positives, narrow or remove that phrase. Raising the global threshold to hide it also makes every genuine detector combination less likely to trigger Block.

How this affects AI responses

Automated detection does not improve the wording or factual quality of an allowed response. Its effect is earlier in the request:

• A blocked message never reaches OpenAI, so the visitor receives the configured security message instead of an AI answer.
• An allowed flagged message continues through the normal assistant, knowledge, and tool flow. The flags and score are stored for administrator review.
• A false positive can therefore either clutter the review queue or, with Block selected, prevent a legitimate question from receiving any answer.
• A missed detection allows normal processing; it does not make the resulting answer unsafe by itself, but it may expose instructions, knowledge, or tools to unwanted probing.

Diagnose an unexpected score

Unexpected scoring and behavior

What you observe	What it usually means and what to inspect
A message scores below the threshold but still appears as flagged.	This is expected. Any detected flag is recorded even below the threshold. The threshold determines when the configured automated action is reached, which changes denial only when the action is Block.
Warn does not show a different visitor warning.	Warn currently follows the same runtime path as Flag: the message is allowed and marked for review. Select Block when denial and the configured block message are required.
The total is higher than the category label suggests.	Count individual matches rather than categories. Several phrases can match in one category, abuse can create both special-character and code-injection flags, and rapid plus repeated behavior can occur together.
A harmless technical question receives a High abuse flag.	Inspect code-like text, SQL phrases, script fragments, and the percentage of special characters. Technical sites may need careful benign test cases before using a low Block threshold.
Repeated-message detection does not keep counting.	Only consecutive identical messages count. Comparison ignores leading/trailing whitespace and letter case, but any different message resets the sequence. The stored history expires after five minutes.
Rapid-message behavior seems inconsistent between tests.	The counter is stored temporarily for the visitor token and expires with the configured rapid window. Use a fresh token or wait for the window before starting a clean timing test.
A known pattern produces no flag.	Confirm its detector is enabled and the pattern is saved as one complete line. For regex, both the opening and closing slash are required; an invalid expression is ignored by the suppressed match check.
Changing the threshold does not reduce the review queue.	That setting is not a minimum logging score. Narrow noisy patterns, change category severity, or disable an unsuitable detector if the flags themselves are not useful.

When reviewing a flagged conversation, count the individual flag rows and translate each severity into 1, 3, 5, or 10 points. The sum should match the stored score. If it does not, check whether a blocked-word High flag was also included or whether the test was performed with older saved settings.

Capture the configuration screen

security-detection

Screenshot capture pending /images/screenshots/security/detection.webp

Automated Detection, Behavior, and Scoring

Capture

Show automated detection controls with all categories, severity choices, threshold 10, and behavior defaults visible.

Show

Jailbreak/abuse/content/behavior toggles, patterns, severities, rapid/repeat values, threshold, action

Viewport

Desktop, 1440 × 900

Annotate

Use numbered callouts only for controls referenced in the procedure.

Redact

OpenAI keys, tokens, secrets, personal information, private URLs, IP addresses, and conversation text

Continue with related security work

• Security overview
• Flagged review