What is a honeypot?

The definition also appears in the NIST glossary, which cites RFC 4949.

A honeypot looks like something worth attacking: a server with an open login, a database with tempting tables, a file named like a password list. It is isolated from real systems and instrumented so that every connection, command and file is recorded.

The value comes from the absence of legitimate traffic. A real server sees thousands of ordinary requests that hide the few hostile ones; a honeypot sees only the hostile ones. That makes alerts from it unusually reliable, and makes it a good source of fresh attack techniques and addresses.

• Low-interaction. Imitates a few services well enough to log connection attempts and simple commands. Cheap and safe, but a skilled attacker notices quickly.
• High-interaction. A real system, deliberately exposed and closely watched. It shows what an attacker does after getting in, and needs strong isolation because the attacker has a real machine.
• Research honeypots. Run by security researchers and vendors to study attacks across the internet.
• Internal honeypots. Placed inside a company network, where no outsider should ever reach, so any contact means someone already got past the perimeter.
• Honeynets. Networks of honeypots that look like a whole environment, to watch how an attacker moves from one machine to the next.

A honeytoken applies the idea to data: a fake credential, document or database row that should never be used. If it shows up in a sign-in attempt or on a paste site, you know where it leaked from.

On a website, a honeypot is usually a form field hidden from people by styling but present in the page code. People never see it and leave it empty; simple bots that fill every field reveal themselves. It asks nothing of real visitors, which is why it is often the first defence against spam bots and appears among the types of CAPTCHA and their alternatives.

It has two weaknesses. Bots written for a specific site skip the field. And browser autofill, password managers and assistive technology can fill a hidden field by mistake, so failing the check should lower a score rather than refuse a submission outright, and the field should be labelled so that screen reader users know to leave it empty.

Outside network security the word has drifted. In cryptocurrency, a honeypot is a scam token or contract that lets people buy but blocks them from selling, so the money flows only to its creator. In espionage, a honeypot is a romantic or sexual lure used to compromise a target. And in everyday speech, a honeypot is anything that attracts people, such as a tourist spot.

All of them share the idea of a lure that looks attractive and works against the person who takes it. On this page, the meaning is the defensive one.

For most website owners, a full honeypot server is more work than it returns: it needs isolation, monitoring and someone to read what it records. Honeypot form fields and honeytokens, such as a fake administrator account that nobody should ever sign in to, give much of the benefit with almost none of the risk.

Larger organisations use internal honeypots as early warning, because an attacker inside the network does not know which machines are real. In every case the rule is the same: the decoy must never be a path to anything real.