Sweet Honeypot

A WordPress plugin that logs HTTP traffic into a dedicated database and provides a dashboard for analysis in the WordPress admin area.

Requirements

• WordPress 6.0 or higher
• PHP 7.4 or higher
• MySQL 5.7+ or MariaDB 10.3+
• A separate MySQL/MariaDB database for the honeypot
• Administrator permissions to view the dashboard

Installation

1. Copy the plugin

Place the sweet-honeypot folder at:

wp-content/plugins/sweet-honeypot/

You can also package it as a ZIP and install it via Plugins → Add New → Upload Plugin.

2. Create the Database

Example in MySQL:

CREATE DATABASE hp_honeypot CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'registro_hp'@'localhost' IDENTIFIED BY 'strong_password';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER, INDEX, REFERENCES
  ON hp_honeypot.* TO 'registro_hp'@'localhost';
FLUSH PRIVILEGES;

3. Configure wp-config.php

Add these constants before the line /* That's all, stop editing! */:

define( 'HP_DB_NAME', 'hp_honeypot' );
define( 'HP_DB_USER', 'registro_hp' );
define( 'HP_DB_PASS', 'strong_password' );
define( 'HP_DB_HOST', 'localhost' );

/** Optional: AbuseIPDB reporting */
define( 'HP_ABUSEIPDB_API_KEY', 'your_api_key' );

Do not store credentials inside the plugin. WordPress.org requires that secrets and keys live in wp-config.php.

4. Activate the Plugin

wp plugin activate sweet-honeypot

Or activate it from Plugins in the WordPress admin dashboard.

5. Configure URL Rewriting

So that non-existent routes like /amazing_url are also logged, WordPress must handle those requests. Make sure you have:

• Permalinks enabled in Settings → Permalinks
• mod_rewrite rules or equivalent in Apache/Nginx

Minimum .htaccess example in the WordPress root:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

6. Update Site URL

If you installed WordPress with http://localhost but access it externally via IP or domain, update:

wp option update home 'http://YOUR-IP-OR-DOMAIN'
wp option update siteurl 'http://YOUR-IP-OR-DOMAIN'

Usage

Admin Dashboard

After activating the plugin, you will see the Honeypot menu in the admin sidebar:

/wp-admin/admin.php?page=hp-admin-dashboard

The dashboard displays:

• Top 5 most requested routes
• Top 5 passwords detected in POST parameters
• Top 5 IPs with the most requests
• 10 most recent routes
• HTTP method distribution

Only users with the manage_options capability can access it.

What Gets Logged

For every request handled by WordPress, the plugin saves:

Data	Table
Main event (IP, method, URI, body, etc.)	hp_events
Filtered HTTP headers	hp_event_headers
GET/POST/COOKIE parameters	hp_event_params
Uploaded file metadata	hp_event_files
Selected server variables	hp_event_server

The tables are created automatically on the first valid request.

AbuseIPDB (Optional)

If you define HP_ABUSEIPDB_API_KEY, the plugin can report POST requests to xmlrpc.php asynchronously.

• Reports are sent only if the constant has a value
• Local rate-limit of 15 minutes per IP
• Does not block the response to the visitor

Useful SQL Queries

SELECT id, ts, INET6_NTOA(client_ip) AS ip, method, request_uri
FROM hp_events
ORDER BY id DESC
LIMIT 20;

SELECT request_uri, COUNT(*) AS total
FROM hp_events
GROUP BY request_uri
ORDER BY total DESC;

Project Structure

sweet-honeypot/
├── sweet-honeypot.php
├── uninstall.php
├── readme.txt
├── README.md
├── LICENSE
├── includes/
│   ├── hp-abuseipdb.php
│   └── hp-admin-dashboard.php
├── assets/
    ├── css/hp-dashboard.css
    └── js/
        ├── chart.umd.min.js
        └── hp-dashboard.js

Uninstallation

When uninstalling the plugin:

• Internal AbuseIPDB transients are removed
• The external hp_honeypot database is not deleted

If you want to delete the data:

DROP DATABASE hp_honeypot;

Security & Privacy

This plugin stores technical traffic data, including IPs, routes, headers, cookies, and request bodies. Use it only if you are authorized to monitor this traffic and always protect access to the dashboard and the database.

License

GPL-2.0-or-later. See LICENSE.