Log In ‹ WordPress

/* ©AngelaMos | 2026 wordpress.go Fake WordPress login and admin pages for the HTTP honeypot Serves a realistic WordPress 6.5 login page that captures credential submissions, a wp-admin redirect, and an xmlrpc.php endpoint that returns standard fault responses. These are the top three paths targeted by automated WordPress exploitation tools. */ package httpd import ( "fmt" "net/http" ) const wpLoginHTML = ` Log In ‹ WordPress — WordPress ` func handleWPLogin(w http.ResponseWriter, r *http.Request) { if r.Method == http.MethodPost { http.Redirect( w, r, "/wp-admin/", http.StatusFound, ) return } w.Header().Set("Content-Type", "text/html; charset=UTF-8") w.Header().Set("X-Powered-By", "PHP/8.1.2-1ubuntu2.19") fmt.Fprint(w, wpLoginHTML) } func handleWPAdmin(w http.ResponseWriter, r *http.Request) { http.Redirect( w, r, "/wp-login.php?redirect_to=%2Fwp-admin%2F&reauth=1", http.StatusFound, ) } const xmlRPCResponse = ` faultCode -32601 faultString Requested method not found. ` func handleXMLRPC(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/xml; charset=UTF-8") fmt.Fprint(w, xmlRPCResponse) }