Best Practices

This guide provides recommendations for maximizing the effectiveness of your WebDecoy deployment.

Decoy Placement Strategies

Strategy 1: Defense in Depth

Deploy multiple layers of decoys:

Layer 1: Visible to crawlers only (robots.txt, hidden links)
    │
Layer 2: JavaScript-accessible (hidden DOM elements)
    │
Layer 3: API honeypots (fake endpoints)
    │
Layer 4: Form honeypots (invisible fields)

Strategy 2: Realistic Naming

Choose paths that attackers target:

Good (realistic):

/admin/backup.zip
/api/v1/admin/users
/wp-config.php.bak
/.env
/db/export.sql

Bad (obvious):

/honeypot.html
/fake-admin
/trap-page

Strategy 3: Strategic Placement

Location	Best For	Example
robots.txt	Malicious crawlers	`Disallow: /admin-backup/`
HTML comments	Source code scanners	`<!-- backup: /old/admin.zip -->`
Hidden links	Automated crawlers	CSS `display:none` link
Form fields	Spam bots	Invisible `website` field
API paths	API scanners	`/api/debug`, `/graphql/admin`

Strategy 4: Decoy Distribution

Spread decoys across your infrastructure:

Area	Decoys Per Area	Priority
Login/Auth	2-3	High
Admin areas	3-5	High
APIs	2-4	High
Content areas	1-2	Medium
Static assets	1-2	Low

Common Decoy Paths

Based on what attackers commonly target:

# Admin Discovery
/admin/
/administrator/
/wp-admin/
/admin.php
/manager/

# Backup Files
/backup.zip
/backup.sql
/database.sql
/db_backup.tar.gz
/site-backup.zip

# Configuration
/.env
/config.php
/wp-config.php.bak
/settings.json
/.git/config

# Debug/Test
/debug/
/phpinfo.php
/test.php
/info.php
/.debug

# API
/api/admin/
/api/debug/
/api/config/
/graphql/admin/
/api/v1/internal/

Reducing False Positives

Tune Detection Sensitivity

Situation	Recommended Sensitivity	Block Threshold
High traffic, public site	Low-Medium	80-90
E-commerce	Medium	75-85
Financial services	High	70-80
Internal applications	High	60-70

Allow Verified Crawlers

WebDecoy’s enforcement allowlist has exactly three categories, each verified against operator-published IP ranges plus forward-confirmed reverse DNS (a cloud VM claiming to be Googlebot fails both checks):

Search engines: Googlebot, Bingbot, and peers
AI crawlers: GPTBot, ClaudeBot, PerplexityBot, and peers
Monitoring services: verified uptime/synthetics providers

There is deliberately no manual user-agent or IP allowlist: proof, not provenance. Your own machine clients (partners, monitors, deployment jobs) pass the gate with machine service tokens instead: per-client Ed25519 credentials you mint on the Enforcement page and revoke individually.

Start in Monitor mode

Before enforcing:

Leave enforcement in Monitor mode (the default). WebDecoy records what it would enforce without pushing anything to your WAF
Run for 1-2 weeks
Review the would-enforce data on the Enforcement page and actor pages
Flip Monitor → Enforce once the data looks right

Monitor False Positive Rate

FP Rate	Action
< 1%	Good - maintain current settings
1-5%	Review allowlists and thresholds
> 5%	Lower sensitivity, raise threshold

Review High-Score Legitimate Traffic

Periodically check for:

Legitimate users with VPNs (common in corporate)
Users with strict privacy settings
Users from hosting/cloud IPs (developers)

Security Operations Integration

Alert Routing

Route detections to appropriate teams:

Score	Routing	Response
80-100	Security team (immediate)	Investigate within 1 hour
60-79	Security team (queue)	Review within 24 hours
40-59	Security monitoring	Weekly review
< 40	Logs only	Monthly trends

SIEM Integration

Send detections to your SIEM for correlation:

Splunk:

sourcetype=webdecoy
| stats count by mitre_tactic, threat_level
| where count > 10

Elastic:

{
  "query": {
    "bool": {
      "filter": [
        { "term": { "source": "webdecoy" } },
        { "range": { "threat_score": { "gte": 70 } } }
      ]
    }
  }
}

Incident Response Playbook

When high-severity detection occurs:

Assess - Review detection details
Validate - Confirm it’s not a false positive
Contain - Block IP if not already blocked
Investigate - Check for related activity
Document - Record incident details
Improve - Update rules/decoys based on findings

Metrics to Track

Metric	Target	Review Frequency
Total detections	Baseline + trend	Daily
High-severity (80+)	Minimize	Daily
False positives	< 1%	Weekly
Mean time to block	< 1 minute	Weekly
Coverage (decoys per area)	2-3 per area	Monthly

Reporting

Regular security reports should include:

Weekly:

Total detection count
High-severity breakdown
New attack patterns
Blocked IP count

Monthly:

MITRE tactic distribution
Geographic trends
False positive rate
Detection coverage assessment

Quarterly:

Year-over-year comparison
Attack sophistication trends
ROI metrics
Recommendations

General Best Practices

Decoy Management

Review and rotate decoys quarterly
Update decoy paths based on attack trends
Remove unused/expired decoys
Document decoy purposes
Test decoys after changes

Monitoring

Check detection dashboard daily
Review high-score detections immediately
Set up alerts for critical detections
Monitor false positive rate
Track detection trends

Maintenance

Keep WordPress plugin updated
Rotate API keys annually
Review integration health monthly
Test SSL certificate renewal
Update allowlists as needed

Security

Use strong, unique API keys
Enable two-factor where available
Limit API key scopes
Review user access regularly
Audit integration permissions

Quick Reference Card

Detection Response Guide

Score	Level	Color	Automated	Manual Action
80-100	CRITICAL	Magenta	Block	Investigate immediately
60-79	HIGH	Red	Challenge/Block	Review within 24h
40-59	MEDIUM	Orange	Log	Weekly review
20-39	LOW	Cyan	Log	Monthly trends
0-19	MINIMAL	Green	Allow	No action needed

Recommended Configuration

Small Business Website:

Sensitivity: Medium
Block Threshold: 80
Rate Limit: 60/min
Decoys: 5-10
Detection Script: Enabled
Form Honeypots: Enabled

E-commerce Store:

Sensitivity: Medium-High
Block Threshold: 75
Rate Limit: 30/min
Decoys: 15-25
Detection Script: Enabled
Form Honeypots: Enabled
WooCommerce Protection: Enabled
Checkout Limit: 5/hour

Enterprise API:

Sensitivity: High
Block Threshold: 65
Rate Limit: 100/min
Decoys: 30+
Detection Script: Enabled (high sensitivity)
Endpoint Honeypots: 10+
WAF Enforcement: AWS WAF connected, Monitor mode reviewed, then Enforce
SIEM Integration: Enabled