Roadmap

Direction. The project begins as a high-interaction honeypot and is heading toward a broader defensive security platform — a security management layer above WordPress + WooCommerce instances that unifies detection, diversion, hardening and observability for the shops it protects. Every item below stays strictly defensive: it may improve how the system observes, diverts, hardens or reports, but the project will never add offensive tracking or offensive security — no hack-back, no callbacks to adversary machines, no retaliation.

Recently Shipped

Items that earlier editions of this page listed as future work and that are now implemented:

• Pool autoscaling — the pool manager builds pools per waiting session plus spares, within a memory / CPU / count budget (POOL_MAX, POOL_MAX_MEMORY_MB, POOL_MAX_CPUS), and retires idle pools. See Honeypot Engine.
• Consent-gated device signature — the one-way gdpr_signature re-recognises a returning visitor after a cookie and storage wipe without storing any PII. See Device & GDPR Signature.
• Database-proxy honeypot layer — an alternative, lighter deception layer that swaps the database per request instead of running separate decoy backends. See Honeypot Layers.
• Generated pattern catalogue — one machine-readable patterns/patterns.json feeds both the dashboard's Pattern Database page and the documentation, so the two cannot drift.

Near-Term

• Additional CVE seeding and detection coverage — expand vulnerability_rules.lua and cve_patterns with newly published WordPress plugin vulnerabilities.
• Enhanced behavioural analytics — extend sophistication_analyzer.lua with additional signals and finer-grained confidence thresholds.
• Dashboard feature improvements — new panel types and improved Kibana visualizations.
• pattern_rules generic-pattern refinement — reduce false positives on legitimate REST API clients.

Mid-Term

• Automated threat-intelligence feed integration — expand the AbuseIPDB bulk feed and integrate additional threat feeds.
• Expanded reporting and alerting automation — webhook-based alerts and Slack / PagerDuty integration.
• Pattern-plugin authoring workflow — add, edit, remove and enable patterns against the catalogue's stable IDs without the dashboard and docs lists drifting apart.
• Device-signature enrichment — additional browser characteristics beyond screen size, still consent-gated and one-way.

Long-Term

• ML-based anomaly detection — a deliberate current choice favours explainable rule-based detection; future hybrid approaches remain possible.
• Multi-environment scaling and multi-tenant support — the first step toward the security-management layer that sits above many WordPress + WooCommerce instances.
• Honeytoken expansion — additional types beyond the current set (API key, database credentials, admin password, S3 URL, JWT secret).
• Adaptive, content-level responses to adversary input (the LLM-driven dynamic-response design is not implemented today).
• Automated eve.json correlation verification for genuine external traffic.