--- title: "Honeypot" description: "A honeypot is a decoy that traps bots and attackers. Types of honeypots, bot traps on a WordPress site and their limitations." language: "en" locale: "en-US" type: "definition" canonical: "https://www.wp-masquerade.com/glossary/honeypot/" published: "2026-10-28T08:00:00+00:00" modified: "2026-10-28T20:04:40+00:00" translations: en-US: "https://www.wp-masquerade.com/glossary/honeypot/index.md" fr-FR: "https://www.wp-masquerade.com/fr/definitions/honeypot/index.md" es-ES: "https://www.wp-masquerade.com/es/glosario/honeypot/index.md" de-DE: "https://www.wp-masquerade.com/de/glossar/honeypot/index.md" it-IT: "https://www.wp-masquerade.com/it/glossario/honeypot/index.md" pt-BR: "https://www.wp-masquerade.com/pt/glossario/honeypot/index.md" nl-NL: "https://www.wp-masquerade.com/nl/woordenlijst/honeypot/index.md" --- # Honeypot A honeypot is a decoy deliberately set up to attract attackers: a fake server, a nonexistent web address or a hidden form field. Since no legitimate user should ever reach it, every interaction points to a bot or an intruder that can be observed, counted or blocked. The principle is simple: you expose something no legitimate user has any reason to touch. Any interaction with that bait is suspicious by nature, which gives a signal with almost no false positives. The IETF Internet Security Glossary (RFC 4949) describes a honeypot as a system or resource designed to be attractive to potential crackers and intruders, “like honey is attractive to bears.” ## The different types of honeypots - **Network or server honeypot**: an isolated machine that imitates a vulnerable service (SSH, database, web server). Researchers and security teams use them to observe attackers' tools and methods. - **Low or high interaction**: a low-interaction honeypot only simulates the surface of a service; a high-interaction honeypot offers a real system, which yields more information but is riskier if poorly isolated. - **Trap URL on a website**: a URL that only bots request, such as `/.env`, `/phpmyadmin` or `/administrator/` on a site that isn't running Joomla!. - **Trap field in a form**: a field hidden with CSS that humans don't see but spam bots fill in. The submission is then discarded without showing a CAPTCHA. ## How a bot trap works Attack bots sweep the internet with lists of well-known URLs: forgotten configuration files, admin tools, login pages of other CMSs. A site that has none of these URLs can turn them into sensors. The response stays an ordinary 404 error, but every request is counted. Past a threshold, the IP address can be blocked for a while: a human doesn't fall into several traps in a row, a scanner does. ![Five-step diagram: the visitor follows the site's links without ever reaching the trap URLs, the bot sweeps URLs such as /.env or /phpmyadmin, each trap URL returns a 404 but is counted, past a threshold the IP address can be banned, and the site keeps a log of tools and targets](https://www.wp-masquerade.com/media/2026/10/honeypot-piege-robot-en.webp) *A bot trap doesn't bother visitors: only clients requesting nonexistent URLs are counted.* To know which URLs to watch, the easiest way is to read your own logs: our article on [scanner bots in server logs](https://www.wp-masquerade.com/scanner-bots-in-your-logs/) covers the most frequent requests and how to respond to them. *Video: “What is a Honeypot?” (PowerCert Animated Videos)* ## For WordPress On a WordPress site, the most telling traps are the URLs you closed yourself: `wp-login.php` after moving the login page, `xmlrpc.php` once [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/) is blocked, `/?author=` when [user enumeration](https://www.wp-masquerade.com/glossary/user-enumeration/) is shut off. A bot that keeps hitting these URLs is almost always preparing a [brute-force attack](https://www.wp-masquerade.com/glossary/brute-force-attack/). - Never ban on a single trap: a broken link or an audit tool can trigger a false positive. - Behind a CDN or a proxy, make sure the real visitor IP address is restored, otherwise everyone shares the proxy's address. - Mention the logs in your privacy policy and limit how long you keep them. ## Limitations A honeypot detects bots and can keep them out, but it doesn't fix any vulnerability. An attacker going straight for a known vulnerable plugin has no need to touch a trap URL. Nor does it replace a [web application firewall](https://www.wp-masquerade.com/glossary/waf/) or protection against distributed attacks. The WP Masquerade [Bot traps](https://www.wp-masquerade.com/features/bot-traps/) module counts bots by family for free (flaws of the imitated CMS, sensitive files, closed WordPress URLs). The Pro version adds banning after a chosen number of traps (three recommended), a 30-day log with truncated IP addresses and fake Joomla! and Drupal login pages. Pages already in cache are still served to a banned bot. ## Related terms - [Brute-force attack](https://www.wp-masquerade.com/glossary/brute-force-attack/) - [WAF (web application firewall)](https://www.wp-masquerade.com/glossary/waf/) - [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/) - [User enumeration](https://www.wp-masquerade.com/glossary/user-enumeration/) - [Fingerprinting](https://www.wp-masquerade.com/glossary/fingerprinting/) ## Sources - [RFC 4949 : Internet Security Glossary, Version 2 (entrée honey pot)](https://www.rfc-editor.org/rfc/rfc4949) - [NIST CSRC Glossary : honeypot](https://csrc.nist.gov/glossary/term/honeypot) - [OWASP : Forced browsing](https://community.owasp.org/attacks/Forced_browsing)