Aystat Honeypot Admin
Decoy login trap & automated bot interception for WordPress published on the official plugin directory.
Automated brute-force bots constantly probe WordPress sites at common administration endpoints like /admin. Aystat Honeypot Admin creates a lightweight decoy trap at these targeted paths, capturing attacker payloads and automated scrapers before they ever reach real authentication logic.
Bot Decoy Engine
Early Request Lifecycle Interception
/wp-admin, /wp-login.php) while allowing custom traps anywhere else.
Official Assets & Defense Capabilities
Visual inspection of decoy settings, live authentic trap views, and real-time intruder logging.
WordPress.org Directory Plugin Banner
Verified and published on the official WordPress.org plugin repository. Engineered with zero frontend bloat, strict security boundaries, and native WordPress admin integration.
Core Honeypot & Interception Features
How the plugin intercepts automated scans before they touch standard authentication routines.
Decoy Slug & Threshold Configuration
Easily configure your decoy login path (/admin, /portal, /sys-login) to lure automated scanners away from real administrative entry points without modifying server rewrites.
Authentic Decoy Authentication Interface
Serves an authentic-looking WordPress login prompt to bots and scrapers. All submitted credentials, usernames, and IP fingerprints are quietly recorded without exposing real system hooks or querying sensitive user tables.
Automated Brute-Force Rate Limiting
Automatically logs failed login attempts from bot networks and locks out persistent attackers after 3 attempts. Banned IPs receive an immediate HTTP 403 Forbidden header early in the request lifecycle, saving server CPU cycles.
Real-Time Intruder Activity Table & Analytics
Stores attacker IP addresses, attempted passwords, user agents, and timestamps in an isolated lightweight database table (wp_aystat_honeypot_logs) with attack frequency charts.
Install Aystat Honeypot Admin from the Official Directory
Freely available on the official WordPress.org plugin directory with automatic updates and verified code standards.
How Bot Interception Works
Early request lifecycle interception with zero overhead on front-end visitors.
Early Request Interception
Hooks into the early WordPress initialization stack via plugins_loaded. Matches the request URI before themes or heavy plugins execute, minimizing server load.
Reserved Path Safeguards
Strictly prevents administrators from overriding critical core paths like /wp-admin or /wp-login.php, preventing accidental lockouts.
Dedicated DB Logging Table
Stores attacker IP, user-agent, attempted username, password payload, and timestamp in an isolated table ({$wpdb->prefix}aystat_honeypot_logs).
Automated Lockout & IP Ban
After reaching the failed attempt threshold (default 3), the attacker IP is served an immediate HTTP 403 Forbidden without executing subsequent WordPress queries.
Technical Specifications
Key compatibility details and operational parameters.
| WordPress Compatibility | Version 5.8 through 7.1+ |
|---|---|
| PHP Version Support | PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5+ |
| Database Engines | MySQL 5.7+, MariaDB 10.3+ |
| WordPress.org Directory | wordpress.org/plugins/aystat-honeypot-admin |
| Frontend Dependencies | Zero (No external scripts or styles loaded on visitor screens) |
| Admin Dependencies | Chart.js (bundled for analytics dashboard) |
| Licensing & Source | GNU General Public License v2 • github.com/stonemanhero/aystat-honeypot-admin |
Need a tailored WordPress plugin or custom security decoy?
I develop bespoke plugins, security integrations, and performance-tuned WordPress solutions.