What Credential stuffing means
Because people reuse passwords, a leak from an unrelated service can unlock your site, email or bank. Unique passwords from a password manager and MFA shut this down. Sites with customer logins should also watch for unusual login patterns.
Why it matters for your website
Because so many people reuse passwords, a breach at one site gives attackers working logins elsewhere, including your customer accounts and staff logins. Successful attacks lead to fraud, stolen data and angry customers. Defenses like two-factor authentication and rate limiting stop most of these attacks.
Example
An online store sees a burst of login attempts from many IP addresses using lists of leaked emails and passwords. Bot protection and two-factor options for customers stop most of them.
Tips
- Offer or require two-factor authentication for customer and staff accounts.
- Use bot protection and rate limiting on login pages.
- Encourage unique passwords and consider checking new passwords against known breach lists.
Common mistakes
- Assuming your site is safe because it was never breached itself.
- Ignoring sudden spikes in failed logins as harmless noise.
Questions about Credential stuffing
What is Credential stuffing?
Using usernames and passwords stolen from one breach to log in to other sites.
How is credential stuffing different from brute force?
Brute force guesses many possible passwords. Credential stuffing uses real username and password pairs leaked from other breaches, betting that people reused them.
How can I check if my password has been leaked?
Services like Have I Been Pwned let you check whether your email appears in known breaches. Many password managers also warn you about exposed or reused passwords.
