---
title: 'VitePot: Honeypot for Vite'
excerpt: 'Static-first Vite and VitePress honeypot plugin for fake sensitive files.'
date: 2026-04-21
categories: open-source, web, security
featureImage: '/images/vitepot.webp'

prev:
  text: 'Appwrite: Rust SDK'
  link: '/blog/appwrite-rust-sdk'

next:
  text: 'Appwrite: Rust Runtime'
  link: '/blog/appwrite-rust-runtime'
---

Recently, I noticed something in the server logs: automated scanners constantly probing for files that do not exist —
`/.env`, `/wp-config.php`, `/backup.sql`, and dozens more.

These bots were not targeting my site specifically. They are just noisy crawlers blindly checking common paths across
the internet, hoping to find misconfigured servers with exposed credentials.

I could ignore them. Or I could waste their time. That's how [**VitePot**](https://vitepot.appwrite.network) was
born.

---

### What is VitePot?

VitePot is a **static-first honeypot plugin** for VitePress and other Vite-powered sites. Instead of leaving common
scanner paths completely empty, it adds realistic-looking bait files that waste bot time and attention.

It currently ships with **43 built-in traps** across multiple categories.

If that is not enough, you can also add your own custom traps for paths you want to bait intentionally.

All generated content uses reserved `.test` domains and RFC 5737 test-net IPs, so nothing points at real
infrastructure.

---

### How does it work?

In development, traps are served from memory. During build, they are emitted as static files. The whole thing stays
small and fits naturally into an existing Vite or VitePress setup.

---

### Usage

1. Add the dependency:
    ```bash
    bun add @itznotabug/vitepot
    ```

2. Use it in your VitePress config:
   ```ts
   // .vitepress/config.mts
   import { defineConfig } from 'vitepress';
   import { vitepot } from '@itznotabug/vitepot';
   
   export default defineConfig({
       vite: {
           plugins: [vitepot()],
       },
   });
   ```

That is it. The default configuration enables the built-in trap set at the site root.

> [!IMPORTANT] Want custom traps too?
>
> You can add your own custom traps as well. See the full docs on [GitHub](https://github.com/itznotabug/vitepot).

---

### Why build this?

1. **Wasting bot resources is fun**.\
   If scanners are going to poke around anyway, they might as well spend that effort parsing fake SQL dumps and bogus
   API keys instead of finding anything useful.

2. **Zero runtime cost.**\
   Since the traps are generated as static files, the site stays simple. No extra app layer, no separate honeypot
   service, and no need to bolt on something heavy just to add a bit of deception.

---

VitePot is available on -

* [GitHub](https://github.com/itznotabug/vitepot) and
* [Node Package Manager](https://www.npmjs.com/package/@itznotabug/vitepot)