Glossary
What is credential stuffing?
Definition
Credential stuffing is an attack where automated tools submit username and password pairs taken from other breaches to a login form, hoping people reused their passwords.
How it works
- The attacker gets a list of leaked login pairs.
- A script tries each pair against your login form, often from many addresses.
- Any pair that works gives access to a real account.
Where it matters
- OWASP names multi-factor authentication as the strongest control against most password attacks.
- A CAPTCHA, rate limits and breached-password checks add friction.
In CaptchaKit
CaptchaKit can protect the WordPress login form, or a custom login form through the widget and a server-side token check. It does not replace MFA.
Questions
How is it different from brute force?
Brute force guesses passwords. Credential stuffing tries known pairs from other breaches.
Do lockouts stop it?
Rarely. Each account sees only a few attempts.
What helps most?
OWASP names multi-factor authentication first.
Source
- OWASP: Credential stuffing (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.