---
title: Credential stuffing
canonical: https://wpsecurityninja.com/dictionary/credential-stuffing/
---
# Credential stuffing

Credential stuffing replays usernames and passwords stolen from other breaches against your login.

[Full guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/)

## FAQ

### Why can stuffing succeed with almost no failed logins?

If the stolen password is correct on the first try, the log shows a normal success. That is why reused admin passwords are dangerous, and why 2FA and reviewing unusual success locations matter as much as counting failures.

### Does changing the login URL stop credential stuffing?

No. Attackers still hit wp-login.php, XML-RPC, or known REST routes. Unique passwords and 2FA stop the account from opening even when the password is already public elsewhere.

## Why it matters for WordPress

People reuse passwords. When another site leaks a list, attackers try those same pairs on WordPress. They are not guessing letter by letter. They are checking whether your users recycled a password from a breach dump.

## How it shows up in practice

- Failed logins with many different usernames, each tried only a few times
- Successful logins that look quiet (few failures) when the stuffed password was correct
- Hits from residential proxies or rotating IPs that dodge simple bans
- Agency shared logins that also appear in unrelated breach lists

## What to do

1. Never reuse the WordPress admin password elsewhere.
2. Require 2FA for privileged roles.
3. Force a password reset if you suspect a leaked account.
4. Rate-limit logins and review unusual success locations.
5. Treat obscure usernames as a small speed bump, not the main control.

## In WP Security Ninja

Pro [login protection](https://wpsecurityninja.com/login-protection/) slows repeated failures, and [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/) means a stuffed password still needs a second factor for privileged roles. The [Events Logger](https://wpsecurityninja.com/events-logger/) records successes and failures so a quiet takeover is easier to spot after the fact.