I want to run a honeypot for doing more research on bots and the economics for them, but I get bogged down quickly in the planning stages. I should just start with a vulnerable wordpress site or something.
A couple of my toy/project websites accidentally became honeypots. Rather than shut down the comment forms, I now have those sites generate summary logfiles that I can upload daily to AbuseIPDB.
EDIT: Forgot to mention, also log the Referer field and User-Agent on each request. Very, very useful information for research and detection.
There are also some vulnerable plugins still out there if you actually want them to hack it.