OpenSec Atlas

openwebui-honeypot: An Open Source Tool for Network Security | OpenSec Atlas

Network Security

Tool

openwebui-honeypot

A Cloudflare Workers-powered smart honeypot and security gateway that detects, rate-limits, and decoys malicious bots to protect OpenWebUI services and conserve API tokens.

View on GitHub

About This Tool

A smart honeypot & security gateway for OpenWebUI, powered by Cloudflare Workers. Blocks bots, prevents token waste, and protects your service.

Primary Use Case

This tool is designed for administrators of OpenWebUI services who want to protect their backend from malicious bots and automated scanners that waste API tokens and degrade service quality. It provides a security gateway that identifies threats, applies rate limits, and returns deceptive responses to confuse attackers, thereby safeguarding resources and improving network security.

Key Features

Multi-vector threat identification using User-Agent and ASN
Smart honeypot returning fake, resource-consuming responses
IP rate-limiting to prevent DoS attacks
Configuration managed via environment variables and KV storage without code changes
One-click deployment to Cloudflare Workers
Blocks malicious requests to protect privacy and conserve LLM tokens

Insights & Recommendations

Use the malicious ASN blocking feature with caution as it may cause false positives. Regularly update your blocklists via the HONEYPOT_CONFIG environment variable to maintain effective protection. This tool requires a publicly accessible OpenWebUI backend URL and a Cloudflare account for deployment.

Installation

Click the 'Deploy to Cloudflare' button in the repository.
Authorize Cloudflare to access your GitHub repository.
Fill in the required environment variables in the deployment wizard: UPSTREAM_URL (your real OpenWebUI backend URL) and optionally HONEYPOT_CONFIG (custom JSON blocklist).
Click 'Deploy' to let Cloudflare automatically create the Worker service and KV namespace with all configurations.
After deployment, point your domain to the newly created Cloudflare Worker.

Usage

Deploy to Cloudflare button

Initiates one-click deployment of the honeypot to your Cloudflare account.

Smart Usage Notes

Integrate with SIEM solutions to correlate honeypot alerts with broader network events for enhanced detection.Leverage the smart honeypot responses to gather attacker TTPs for threat intelligence enrichment.Use rate-limiting data to dynamically adjust firewall and WAF rules, improving automated defense.Deploy as a front-line defense in cloud-native environments to reduce API token abuse and service degradation.Combine with deception frameworks to create multi-layered traps increasing attacker dwell time and exposure.