Closing the Account Takeover Gap
Credential stuffing and brute-force attacks remain a persistent threat to authentication endpoints. With large datasets of breached credentials readily available, attackers can test millions of username/password pairs in seconds. When users reuse passwords across services, a breach anywhere can become a compromise of your application. Cloudflare's edge platform now offers several complementary features that can be layered together to protect end user accounts.
Managed Open Proxy List
Attackers often route credential stuffing attempts through open proxy services to hide their origin. While IP lists have been available for custom Firewall Rules since July 2020, maintaining those lists manually is an ongoing burden—they quickly become stale.
A new Cloudflare-managed Open Proxies list automates that maintenance. The list is populated based on observed network traffic and proactive searching of open proxy endpoints, and it is updated hourly. Enterprise customers can reference it in custom Firewall Rules using the standard wirefilter syntax, then apply a BLOCK or CHALLENGE action to any authentication traffic that matches.
A rule leveraging the new list in wirefilter syntax would be:
http.request.uri.path contains "/login" and (not ip.src in $cf.open_proxies and cf.bot_management.score < 30)Bot Mitigation for Login Endpoints
Login pages are a prime target for bot traffic; bad bots will keep testing credentials until they extract value. Super Bot Fight Mode provides real-time bot detection and is included in Pro and Business plans. It runs on the same detection engines that power the Enterprise Bot Management product. Pro users can block or challenge "definite bots," while Business users can also target more sophisticated "likely bots." Free plan users retain access to the basic Bot Fight Mode toggle.
Exposed Credential Checks
Most account takeovers succeed because users reuse passwords across multiple services, so your account security depends partly on the security of unrelated systems. A new WAF feature addresses this directly: Exposed Credential Checks. Because all login requests for any Cloudflare-protected application already pass through the WAF, the check can happen on-path without any additional network round trips.
When enabled, the WAF hashes the submitted username/password pair against a database of known breached credentials that Cloudflare maintains. If a match is found, the WAF adds a header to the origin request so your application can trigger a password reset flow or force a second-factor challenge.
The credentials themselves are never exposed outside the WAF process. The lookup uses a privacy-preserving cryptographic protocol: a keyed hash function is applied within the WAF process, and the result is compared to keyed hashes of known-breached pairs. No username, password, or plaintext hash is transmitted, logged, or visible to Cloudflare staff.
The feature is available in two forms: a managed ruleset that works out of the box with common systems like WordPress and Joomla, and a filter for custom rules to support any other application. Enterprise customers can request access today; a deeper technical explanation of the protocol will follow.
Device Posture with Cloudflare Access
Valid credentials used from a compromised device can still lead to data exfiltration. Cloudflare Access can now enforce that only managed corporate devices reach sensitive applications. Access rules can verify a device's serial number against a managed device list before granting access. Even with stolen credentials in hand, an attacker on an unmanaged device will be denied.
Rate Limiting Failed Login Attempts
A simple but effective defense against brute-force attacks is to slow them down until they become too expensive. Failed login attempts typically return an HTTP 403 status or another recognisable error—these are reliable signals for rate limiting that do not impact legitimate users.
The rule above limits any IP to five failed login attempts per minute, then blocks further attempts for one hour. Responses are customisable for plain HTML or JSON-based API endpoints. Rate limiting is available as a paid add-on to all self-service plans.
Looking Ahead
The managed open proxy list is one example of using network-scale visibility to improve account security. Anomaly-based detection and broader sharing of verified threat intelligence across the customer base are currently in the works, building on Cloudflare's original model of community-driven protection.
