feat: honeytoken hidden-link injection (#4) - #23
Merged
Merged
Conversation
Completes the tripwire deception loop: WordPress owns page rendering, so the
plugin plants the bait automatically (unlike @webdecoy/node, where the dev
embeds the link by hand).
- WebDecoy_Honeytoken: derives a secret per-site /__wd/{token} path by HMAC
from a stored secret (no extra storage, unguessable). Optional daily
rotation keeps yesterday's token armed as a grace window. render_link()
matches node's exact hiding technique (offscreen, aria-hidden, tabindex
-1, nofollow/noindex).
- Injected on wp_footer, front-end only; skipped for logged-in users, feeds,
REST, AJAX, cron — a real/authenticated session can never trip it.
- Armed as a dedicated tripwire rule independent of the general tripwire
toggle, so a hit gets the full DENY + violation + clearance-forwarding
treatment. On by default; no robots.txt entry (that would advertise it).
- tests/HoneytokenTest.php: token derivation, hidden-link markup, rotation
grace window, and end-to-end trip (23 assertions total, green).
Closes #4. Part of #16.
Co-authored-by: Claude <noreply@anthropic.com>
15 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the tripwire deception loop. Tripwires (#3) block honeypot paths, but something has to lead scrapers to them — this auto-plants that bait. WordPress owns page rendering, so injection is automatic (in
@webdecoy/nodethe developer embeds the link by hand).What's here
WebDecoy_Honeytoken— derives a secret per-site/__wd/{token}path by HMAC from a stored secret (unguessable, no extra storage).render_link()matches node's exact hiding technique byte-for-byte: offscreen (position:absolute;left:-9999px),aria-hidden="true",tabindex="-1",rel="nofollow noindex".wp_footer, front-end only — skipped for logged-in users, feeds, REST, AJAX, and cron, so a genuine or authenticated session can never trip it.wd_clearance-forwarding path from wd_clearance server half — cookie capture + forwarding on tripwire violations #5.robots.txtentry — aDisallow: /__wd/line would advertise the trap.Tests
tests/HoneytokenTest.php(self-contained WP stubs): token derivation/stability, the hidden-link markup, rotation grace window, and an end-to-end check that requesting the path denies while normal pages pass. Full suite now 23 assertions, green (php tests/run.php).Closes #4. Part of #16.