Home › Docs › Documentation

Documentation

Technical documentation for PressHaven

This knowledge hub documents PressHaven: a defensive security platform for a WordPress/WooCommerce storefront behind an OpenResty reverse proxy that scores every request in Lua and diverts suspicious sessions into isolated honeypot pools. Today it is a high-interaction honeypot; the goal is to grow into a security management layer above WordPress + WooCommerce instances. The pages are written against the modules and deployment files in github.com/presshaven/presshaven.

Defensive only. Everything here operates on the defender's own infrastructure: it observes, diverts and records. The system performs no offensive tracking and no offensive security — no hack-back, no beacons or callbacks to adversary machines, no retaliation. Deception serves solely to protect the real store.

Start Here

New here? Getting Started Prerequisites, the dashboard setup path, the manual Docker Compose path, and the first checks that prove the stack is alive. ~10 min read Mental model Architecture The pure/adapter split, the request pipeline, the twelve-stage router, pooling and the GDPR identity path. Start with the pipeline

Documentation Sections

WordPress layer Honeypot Engine Production and pool shops, the two deception layers, seeding, content replication, backups, dashboard-driven WordPress management and the lifecycle of an isolated pool. 6 sections 6 pages Detection Pattern and header analysis, seeded CVEs, Suricata correlation, the generated pattern catalogue, AbuseIPDB mapping, escalation-aware decay and the device signature. 13 CVEs · WSTG mapped 3 pages Observability Structured security events, the mTLS Vector → Elasticsearch → Kibana path, dashboard generation and the request timeline. 6 dashboards 5 pages Operations Two-host and single-host deployment, hardening, the full configuration reference and troubleshooting runbooks. 2 topologies 2 pages Testing Twenty-three pure-Lua unit test files, dashboard tests, scenario scripts and the blind pentest protocol. 23 test files 6 pages Reference Glossary, known issues with workarounds, roadmap, changelog, primary literature and module tables. Glossary · roadmap

Reading Paths

Three common ways through the material, depending on what you need to do.

Operator Operate the system Deployment topologies, hardening, configuration defaults and the runbooks for services, incidents and stale dashboards. Analyst Understand detection How each signal is scored, which CVEs are seeded, how Suricata feeds the score and when a reason is reportable. Developer Change the code Where the pure rules live, which adapter performs the I/O and how the routing decision is composed from predicates.

What This Documentation Covers

Edge behaviour — request scoring, routing, session identity, pool assignment and response headers.
Deception environment — the WordPress/WooCommerce layer, seeding, content sync and backups.
Telemetry — security event schema, Suricata ingestion, Vector pipelines and Kibana saved objects.
Operations — two-host and single-host layouts, hardening, environment variables and recovery procedures.
Validation — unit suites, scenario scripts, dashboard tests and the blind pentest methodology.

Historical notes and corrections are tracked in the changelog and known issues pages. The complete function-level reference is kept alongside the Lua modules; this hub links to the relevant module for every behaviour it describes.