{
    "title": "Honeypot",
    "seo_title": "Honeypot: definition and use on websites",
    "h1": "Honeypot",
    "description": "A honeypot is a decoy that traps bots and attackers. Types of honeypots, bot traps on a WordPress site and their limitations.",
    "lead": "A honeypot is a decoy deliberately set up to attract attackers: a fake server, a nonexistent web address or a hidden form field. Since no legitimate user should ever reach it, every interaction points to a bot or an intruder that can be observed, counted or blocked.",
    "language": "en",
    "locale": "en-US",
    "type": "definition",
    "url": "https://www.wp-masquerade.com/glossary/honeypot/",
    "canonical": "https://www.wp-masquerade.com/glossary/honeypot/",
    "markdown": "https://www.wp-masquerade.com/glossary/honeypot/index.md",
    "json": "https://www.wp-masquerade.com/glossary/honeypot/index.json",
    "published": "2026-10-28T08:00:00+00:00",
    "modified": "2026-10-28T20:04:40+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Honeypot",
            "url": "https://www.wp-masquerade.com/glossary/honeypot/",
            "markdown": "https://www.wp-masquerade.com/glossary/honeypot/index.md",
            "json": "https://www.wp-masquerade.com/glossary/honeypot/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Honeypot (pot de miel)",
            "url": "https://www.wp-masquerade.com/fr/definitions/honeypot/",
            "markdown": "https://www.wp-masquerade.com/fr/definitions/honeypot/index.md",
            "json": "https://www.wp-masquerade.com/fr/definitions/honeypot/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Honeypot (señuelo)",
            "url": "https://www.wp-masquerade.com/es/glosario/honeypot/",
            "markdown": "https://www.wp-masquerade.com/es/glosario/honeypot/index.md",
            "json": "https://www.wp-masquerade.com/es/glosario/honeypot/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Honeypot",
            "url": "https://www.wp-masquerade.com/de/glossar/honeypot/",
            "markdown": "https://www.wp-masquerade.com/de/glossar/honeypot/index.md",
            "json": "https://www.wp-masquerade.com/de/glossar/honeypot/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Honeypot",
            "url": "https://www.wp-masquerade.com/it/glossario/honeypot/",
            "markdown": "https://www.wp-masquerade.com/it/glossario/honeypot/index.md",
            "json": "https://www.wp-masquerade.com/it/glossario/honeypot/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Honeypot",
            "url": "https://www.wp-masquerade.com/pt/glossario/honeypot/",
            "markdown": "https://www.wp-masquerade.com/pt/glossario/honeypot/index.md",
            "json": "https://www.wp-masquerade.com/pt/glossario/honeypot/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Honeypot",
            "url": "https://www.wp-masquerade.com/nl/woordenlijst/honeypot/",
            "markdown": "https://www.wp-masquerade.com/nl/woordenlijst/honeypot/index.md",
            "json": "https://www.wp-masquerade.com/nl/woordenlijst/honeypot/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Honeypot"
        },
        {
            "level": 2,
            "text": "The different types of honeypots"
        },
        {
            "level": 2,
            "text": "How a bot trap works"
        },
        {
            "level": 2,
            "text": "For WordPress"
        },
        {
            "level": 2,
            "text": "Limitations"
        }
    ],
    "body": "The principle is simple: you expose something no legitimate user has any reason to touch. Any interaction with that bait is suspicious by nature, which gives a signal with almost no false positives. The IETF Internet Security Glossary (RFC 4949) describes a honeypot as a system or resource designed to be attractive to potential crackers and intruders, “like honey is attractive to bears.”\n\n## The different types of honeypots\n\n- **Network or server honeypot**: an isolated machine that imitates a vulnerable service (SSH, database, web server). Researchers and security teams use them to observe attackers' tools and methods.\n- **Low or high interaction**: a low-interaction honeypot only simulates the surface of a service; a high-interaction honeypot offers a real system, which yields more information but is riskier if poorly isolated.\n- **Trap URL on a website**: a URL that only bots request, such as `/.env`, `/phpmyadmin` or `/administrator/` on a site that isn't running Joomla!.\n- **Trap field in a form**: a field hidden with CSS that humans don't see but spam bots fill in. The submission is then discarded without showing a CAPTCHA.\n\n## How a bot trap works\n\nAttack bots sweep the internet with lists of well-known URLs: forgotten configuration files, admin tools, login pages of other CMSs. A site that has none of these URLs can turn them into sensors. The response stays an ordinary 404 error, but every request is counted. Past a threshold, the IP address can be blocked for a while: a human doesn't fall into several traps in a row, a scanner does.\n\n![Five-step diagram: the visitor follows the site's links without ever reaching the trap URLs, the bot sweeps URLs such as /.env or /phpmyadmin, each trap URL returns a 404 but is counted, past a threshold the IP address can be banned, and the site keeps a log of tools and targets](https://www.wp-masquerade.com/media/2026/10/honeypot-piege-robot-en.webp)\n\n*A bot trap doesn't bother visitors: only clients requesting nonexistent URLs are counted.*\n\nTo know which URLs to watch, the easiest way is to read your own logs: our article on [scanner bots in server logs](https://www.wp-masquerade.com/scanner-bots-in-your-logs/) covers the most frequent requests and how to respond to them.\n\n*Video: “What is a Honeypot?” (PowerCert Animated Videos)*\n\n## For WordPress\n\nOn a WordPress site, the most telling traps are the URLs you closed yourself: `wp-login.php` after moving the login page, `xmlrpc.php` once [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/) is blocked, `/?author=` when [user enumeration](https://www.wp-masquerade.com/glossary/user-enumeration/) is shut off. A bot that keeps hitting these URLs is almost always preparing a [brute-force attack](https://www.wp-masquerade.com/glossary/brute-force-attack/).\n\n- Never ban on a single trap: a broken link or an audit tool can trigger a false positive.\n- Behind a CDN or a proxy, make sure the real visitor IP address is restored, otherwise everyone shares the proxy's address.\n- Mention the logs in your privacy policy and limit how long you keep them.\n\n## Limitations\n\nA honeypot detects bots and can keep them out, but it doesn't fix any vulnerability. An attacker going straight for a known vulnerable plugin has no need to touch a trap URL. Nor does it replace a [web application firewall](https://www.wp-masquerade.com/glossary/waf/) or protection against distributed attacks.\n\nThe WP Masquerade [Bot traps](https://www.wp-masquerade.com/features/bot-traps/) module counts bots by family for free (flaws of the imitated CMS, sensitive files, closed WordPress URLs). The Pro version adds banning after a chosen number of traps (three recommended), a 30-day log with truncated IP addresses and fake Joomla! and Drupal login pages. Pages already in cache are still served to a banned bot.\n\n## Related terms\n\n- [Brute-force attack](https://www.wp-masquerade.com/glossary/brute-force-attack/)\n- [WAF (web application firewall)](https://www.wp-masquerade.com/glossary/waf/)\n- [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/)\n- [User enumeration](https://www.wp-masquerade.com/glossary/user-enumeration/)\n- [Fingerprinting](https://www.wp-masquerade.com/glossary/fingerprinting/)\n\n\n## Sources\n\n- [RFC 4949 : Internet Security Glossary, Version 2 (entrée honey pot)](https://www.rfc-editor.org/rfc/rfc4949)\n- [NIST CSRC Glossary : honeypot](https://csrc.nist.gov/glossary/term/honeypot)\n- [OWASP : Forced browsing](https://community.owasp.org/attacks/Forced_browsing)",
    "definition": "A honeypot is a decoy deliberately set up to attract attackers: a fake server, a nonexistent web address or a hidden form field. Since no legitimate user should ever reach it, every interaction points to a bot or an intruder that can be observed, counted or blocked.",
    "group": "Web security",
    "aka": [
        "honey pot",
        "bot trap",
        "decoy",
        "spam trap"
    ],
    "related": [
        {
            "title": "Brute-force attack",
            "url": "https://www.wp-masquerade.com/glossary/brute-force-attack/",
            "markdown": "https://www.wp-masquerade.com/glossary/brute-force-attack/index.md"
        },
        {
            "title": "WAF (web application firewall)",
            "url": "https://www.wp-masquerade.com/glossary/waf/",
            "markdown": "https://www.wp-masquerade.com/glossary/waf/index.md"
        },
        {
            "title": "XML-RPC",
            "url": "https://www.wp-masquerade.com/glossary/xml-rpc/",
            "markdown": "https://www.wp-masquerade.com/glossary/xml-rpc/index.md"
        },
        {
            "title": "User enumeration",
            "url": "https://www.wp-masquerade.com/glossary/user-enumeration/",
            "markdown": "https://www.wp-masquerade.com/glossary/user-enumeration/index.md"
        },
        {
            "title": "Fingerprinting",
            "url": "https://www.wp-masquerade.com/glossary/fingerprinting/",
            "markdown": "https://www.wp-masquerade.com/glossary/fingerprinting/index.md"
        }
    ],
    "sources": [
        {
            "title": "RFC 4949 : Internet Security Glossary, Version 2 (entrée honey pot)",
            "url": "https://www.rfc-editor.org/rfc/rfc4949"
        },
        {
            "title": "NIST CSRC Glossary : honeypot",
            "url": "https://csrc.nist.gov/glossary/term/honeypot"
        },
        {
            "title": "OWASP : Forced browsing",
            "url": "https://community.owasp.org/attacks/Forced_browsing"
        }
    ],
    "format": "application/json"
}