Attacks Dictionary
Credential stuffing
Definition
Credential stuffing replays usernames and passwords stolen from other breaches against your login.
Also called: credential-stuffing
Why it matters for WordPress
People reuse passwords. When another site leaks a list, attackers try those same pairs on WordPress. They are not “guessing” letter by letter. They are checking whether your users recycled a password.
How it shows up in practice
- Failed logins with many different usernames, each tried only a few times
- Successful logins that look “quiet” (few failures) if the stuffed password was correct
- Hits from residential proxies or rotating IPs that dodge simple bans
What to do
- Never reuse the WordPress admin password elsewhere.
- Require 2FA for privileged roles.
- Force a password reset if you suspect a leaked account.
- Rate-limit logins and alert on unusual success locations.
- Prefer email login or obscure usernames only as a small speed bump, not as the main control.
In WP Security Ninja
Pro login protection slows repeated failures, and 2FA means a stuffed password still needs a second factor for privileged roles. The Events Logger still records login successes and failures so quiet successful stuffing is easier to spot after the fact.
Related terms
Nearby ideas in the dictionary
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Phishing Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.