Credential stuffing
Definition
Credential stuffing replays usernames and passwords stolen from other breaches against your login.
Also called: credential-stuffing
Why it matters for WordPress
People reuse passwords. When another site leaks a list, attackers try those same pairs on WordPress. They are not guessing letter by letter. They are checking whether your users recycled a password from a breach dump.
How it shows up in practice
- Failed logins with many different usernames, each tried only a few times
- Successful logins that look quiet (few failures) when the stuffed password was correct
- Hits from residential proxies or rotating IPs that dodge simple bans
- Agency shared logins that also appear in unrelated breach lists
What to do
- Never reuse the WordPress admin password elsewhere.
- Require 2FA for privileged roles.
- Force a password reset if you suspect a leaked account.
- Rate-limit logins and review unusual success locations.
- Treat obscure usernames as a small speed bump, not the main control.
In WP Security Ninja
Pro login protection slows repeated failures, and 2FA means a stuffed password still needs a second factor for privileged roles. The Events Logger records successes and failures so a quiet takeover is easier to spot after the fact.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Phishing Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
- Account takeover Account takeover is when an attacker gains control of a legitimate user account and can act as that user.
