Best Practices

This guide provides recommendations for maximizing the effectiveness of your WebDecoy deployment.

---

Decoy Placement Strategies

Strategy 1: Defense in Depth

Deploy multiple layers of decoys:

Layer 1: Visible to crawlers only (robots.txt, hidden links)
    │
Layer 2: JavaScript-accessible (hidden DOM elements)
    │
Layer 3: API honeypots (fake endpoints)
    │
Layer 4: Form honeypots (invisible fields)

Strategy 2: Realistic Naming

Choose paths that attackers target:

Good (realistic):

• /admin/backup.zip
• /api/v1/admin/users
• /wp-config.php.bak
• /.env
• /db/export.sql

Bad (obvious):

• /honeypot.html
• /fake-admin
• /trap-page

Strategy 3: Strategic Placement

Location	Best For	Example
robots.txt	Malicious crawlers	Disallow: /admin-backup/
HTML comments	Source code scanners	<!-- backup: /old/admin.zip -->
Hidden links	Automated crawlers	CSS display:none link
Form fields	Spam bots	Invisible website field
API paths	API scanners	/api/debug, /graphql/admin

Strategy 4: Decoy Distribution

Spread decoys across your infrastructure:

Area	Decoys Per Area	Priority
Login/Auth	2-3	High
Admin areas	3-5	High
APIs	2-4	High
Content areas	1-2	Medium
Static assets	1-2	Low

Common Decoy Paths

Based on what attackers commonly target:

# Admin Discovery
/admin/
/administrator/
/wp-admin/
/admin.php
/manager/

# Backup Files
/backup.zip
/backup.sql
/database.sql
/db_backup.tar.gz
/site-backup.zip

# Configuration
/.env
/config.php
/wp-config.php.bak
/settings.json
/.git/config

# Debug/Test
/debug/
/phpinfo.php
/test.php
/info.php
/.debug

# API
/api/admin/
/api/debug/
/api/config/
/graphql/admin/
/api/v1/internal/

---

Reducing False Positives

Tune Detection Sensitivity

Situation	Recommended Sensitivity	Block Threshold
High traffic, public site	Low-Medium	80-90
E-commerce	Medium	75-85
Financial services	High	70-80
Internal applications	High	60-70

Allow Verified Crawlers

WebDecoy’s enforcement Access exceptions let verified bots through by behavior (Search, AI training crawlers, Link previews, Uptime and analytics, and others). Verification uses operator-published IP ranges, forward-confirmed reverse DNS, or a cryptographic signature, so a cloud VM claiming to be Googlebot fails. See Good Bots.

There is deliberately no manual user-agent or IP allowlist: proof, not provenance. Your own machine clients (partners, monitors, deployment jobs) pass the gate with machine service tokens instead: per-client Ed25519 credentials you mint on the Enforcement page and revoke individually.

Start in Monitor mode

Before enforcing:

1. Leave enforcement in Monitor mode (the default). WebDecoy records what it would enforce without pushing anything to your WAF
2. Run for 1-2 weeks
3. Review the would-enforce data on the Enforcement page and actor pages
4. Flip Monitor → Enforce once the data looks right

Monitor False Positive Rate

FP Rate	Action
< 1%	Good - maintain current settings
1-5%	Review allowlists and thresholds
> 5%	Lower sensitivity, raise threshold

Review High-Score Legitimate Traffic

Periodically check for:

• Legitimate users with VPNs (common in corporate)
• Users with strict privacy settings
• Users from hosting/cloud IPs (developers)

---

Security Operations Integration

Alert Routing

Route detections to appropriate teams:

Score	Routing	Response
80-100	Security team (immediate)	Investigate within 1 hour
60-79	Security team (queue)	Review within 24 hours
40-59	Security monitoring	Weekly review
< 40	Logs only	Monthly trends

SIEM Integration

Send detections to your SIEM for correlation:

Splunk (default sourcetype webdecoy:detection; see Splunk for the fields sent):

sourcetype="webdecoy:detection"
| stats count by threat_category, threat_level
| where count > 10

WebDecoy forwards natively to Splunk, CrowdStrike Falcon LogScale, and Datadog. Other SIEMs (for example Elastic) can receive detections through a generic webhook.

Incident Response Playbook

When high-severity detection occurs:

1. Assess - Review detection details
2. Validate - Confirm it’s not a false positive
3. Contain - Block the IP or actor at your WAF if warranted
4. Investigate - Check for related activity
5. Document - Record incident details
6. Improve - Update rules/decoys based on findings

Metrics to Track

Metric	Target	Review Frequency
Total detections	Baseline + trend	Daily
High-severity (80+)	Minimize	Daily
False positives	< 1%	Weekly
Coverage (decoys per area)	2-3 per area	Monthly

Reporting

Regular security reports should include:

Weekly:

• Total detection count
• High-severity breakdown
• New attack patterns
• Blocked IP count

Monthly:

• MITRE tactic distribution
• Geographic trends
• False positive rate
• Detection coverage assessment

Quarterly:

• Year-over-year comparison
• Attack sophistication trends
• ROI metrics
• Recommendations

---

General Best Practices

Decoy Management

• Review and rotate decoys quarterly
• Update decoy paths based on attack trends
• Remove unused/expired decoys
• Document decoy purposes
• Test decoys after changes

Monitoring

• Check detection dashboard daily
• Review high-score detections immediately
• Set up alerts for critical detections
• Monitor false positive rate
• Track detection trends

Maintenance

• Keep WordPress plugin updated
• Rotate API keys annually
• Review integration health monthly
• Test SSL certificate renewal
• Update allowlists as needed

Security

• Use strong, unique API keys
• Enable two-factor where available
• Limit API key scopes
• Review user access regularly
• Audit integration permissions

---

Quick Reference Card

Detection Response Guide

Score	Level	Suggested Action
80-100	CRITICAL	Investigate immediately; consider blocking at your WAF
60-79	HIGH	Review within 24h
40-59	MEDIUM	Weekly review
20-39	LOW	Monthly trends
0-19	MINIMAL	No action needed

Score-driven automatic blocking is not switched on yet; blocks come from your own response actions and manual decisions.

Starting Points

These are suggestions, not measured optimums. Sensitivity and the block threshold are WordPress plugin settings (Protection tab); the Node SDK has its own options.

Small Business Website:

Sensitivity: Medium
Minimum Score to Block: 80
Decoys: 5-10
Detection Script: Enabled

E-commerce Store:

Sensitivity: Medium
Minimum Score to Block: 75
Decoys: 15-25
Detection Script: Enabled

API-heavy application:

Endpoint decoys on paths scanners probe
Detection Script: Enabled on any browser-facing pages
WAF enforcement: connect a provider, review Monitor mode, then Enforce
SIEM forwarding: Splunk, LogScale, or Datadog