What the decoys are
Each decoy sits where attack tools look first:
- fake secret files: /.env, /.git/config, cloud keys and a backup zip, holding keys that report back when used
- a fake admin login that tells a person, a scripted bot and an AI browser agent apart by how the form is filled
- fake API docs and a fake AI tool server for agents that read before they act
- a hidden link that only something ignoring robots.txt would follow
- a note only an AI agent would read, asking it to identify itself
What it has caught
On our own sites, a scanner took a fake AWS key from a decoy file and within three hours tried it against AWS: listing servers, checking whether it could send email, then trying to create keys and give itself admin rights. The key was a decoy, so nothing was at risk. On a real site, that is a takeover.
The same week, an AI agent read the note meant only for AI and checked in an hour later from a different address.
Why it never hurts search
Verified Google, Bing, Apple, DuckDuckGo and AI search crawlers get a plain "not found" on every decoy path, and the decoys are listed as off limits in robots.txt. Only something that ignores the rules ever reaches one. The honeypot never blocks visitors and never fights back.
Install it
Free for WordPress (a plugin), Cloudflare, Next.js and Express (npm install agentdecoy). Each catch says whether it was a script, a person or an AI agent (and how sure: confirmed by speed or signature, likely, possible), how far it got, and which network the address belongs to; an address that used a stolen secret on one Guard site is flagged on every other one.
Questions
What is a website honeypot?
A fake but tempting thing on your site, such as a secret file or an admin login, that no real visitor would touch. Anything that touches it is a scanner or attacker, so it tells you who is probing your site.
Does a honeypot hurt SEO?
Not this one. Verified search and AI search crawlers get a plain not-found on the decoy paths, and the paths are disallowed in robots.txt.
Can a honeypot catch AI agents?
Yes. Agents read pages and act on what they find, so a note only AI reads, fake API docs and fake keys catch the ones that act. Every catch is sorted into script, browser or AI agent.
Is it safe to put fake keys on my site?
Yes. The keys are fake, give access to nothing, and only report that someone tried to use them. The decoys never attack back.
Sources: Live decoys, Agent Attack Index, Guard
Want it done for you?
Every result lists the fixes with starting prices, or I can look at your site with you. Pro re-checks it every week for $12 a month, 7 days free.