How a Personal Site Counts Bots Without Storing Any IPs: Pure PHP, No Database, Strict CSP and 160 Tests

A personal website demonstrates how to implement robust security controls while tracking bot behavior from an SSH honeypot without ever storing or publishing visitor IP addresses. The project began with the first commit on 25 October 2026 and now contains 243 commits, roughly 22,000 lines of PHP, JavaScript and CSS, plus 5,000 lines of supporting Bash and Python scripts.

Architecture Without Frameworks or Databases

All content resides in a single JSON file. Atomic saves are performed by writing to a temporary file and then using rename(), ensuring readers never see a partially written state. Before each save the previous version is copied to a backups directory that retains the last twenty revisions. This approach removes the need for a separate database process, user accounts, migrations or dump-based backups.

Because no framework is present, the author implemented input sanitization, CSRF tokens, session handling and rate limiting manually. The absence of framework protections became the direct reason for writing an extensive test suite that actively attacks the application.

Strict Content-Security-Policy Implementation

The enforced policy allows scripts only from the same origin and only when accompanied by a fresh nonce. Inline styles are completely forbidden. Graphs and progress bars are rendered as SVG elements using width and height attributes rather than style properties. Dynamic style changes are applied through the CSSOM API. Data intended for JavaScript is placed inside <script type="application/json"> blocks that are parsed rather than executed.

A dedicated test verifies that every nonce is unique per response, that no script tag lacks either a nonce or the JSON type, and that the style attribute never appears in rendered HTML. Violations reported through CSP report-to endpoints surface forgotten nonces before they become visible to visitors.

Automated Attack-Driven Testing

The PHP test suite contains 160 checks and completes in approximately twenty seconds. Each test spins up an isolated instance of the site on a temporary data copy. Test data deliberately contains XSS strings, terminal escape sequences, malformed host headers and path traversal attempts. Separate checks cover reflected XSS, Host header injection, SSRF via audit.json, password brute-force protection after five failures, CSRF token validation, EXIF GPS stripping from JPEG uploads, and blocking of access to .git, data files and parent directories.

Browser tests written in Python drive a real Chromium instance through the DevTools Protocol. They validate 35 pages at two viewport sizes, confirming absence of console errors, horizontal scrolling on mobile, sufficient contrast, correct heading order, visible focus indicators, reduced-motion compliance and adherence to a strict performance budget of 400 KB total weight and 25 requests.

Bot Tracking Without Publishing Addresses

Raw SSH session logs contain full IP addresses, but only behavioral signatures leave the honeypot system. Each session is reduced to its first twelve cleaned commands; numbers are normalized to N and a short SHA-1 hash is computed. Sessions sharing the same hash are treated as one bot family. A special rule handles the common “uname” reconnaissance command so that minor flag variations do not create spurious families.

Address cardinality is calculated in memory and only the count is published. Families observed from fewer than three distinct addresses are suppressed entirely. Additional signals such as HASSH client fingerprints, password lists and command overlap percentages help distinguish separate operators even when they reuse the same script.