Most Logins Use Credentials That Have Already Leaked

Nearly every online interaction begins with a login prompt, and the credentials submitted there often determine whether an account stays secure or falls into the wrong hands. According to traffic observed across Cloudflare's network between September and November 2024, 41% of successful human logins on Cloudflare-protected sites relied on passwords already exposed in known data breaches. That figure climbs to 52% when automated bot traffic is included in the analysis.

How the data was gathered

Cloudflare offers a free leaked-credential detection feature as part of its Application Security offering. The system checks passwords against a database of over 15 billion known breach records, including the Have I Been Pwned dataset. Crucially, the service operates without ever accessing or storing plaintext passwords; credentials are hashed and compared against the breach database using a privacy-preserving process.

The analysis covers traffic from sites on Cloudflare's free plan, which includes leak detection by default. With roughly 30 million Internet properties behind the company's network, representing about 20% of the web, the dataset provides a broad view of authentication patterns. The observations primarily reflect trends since the detection system launched during Cloudflare's Birthday Week in September 2024.

Focusing on successful authentication attempts that return HTTP 200 OK status codes offers a clear window into legitimate user activity. The finding that 41% of those successful logins involve compromised passwords points squarely at a persistent problem: users continue to recycle credentials across multiple services. A Forbes study cited in the analysis indicates that an average user reuses a single password across four different accounts. Even after major breaches, many users never rotate the exposed passwords, or they only tweak them slightly for use on other platforms.

Expanding the lens to include all detected authentication requests, both human and automated, reveals that 52% include leaked passwords. That translates into hundreds of millions of daily requests containing compromised credentials, many of which still grant valid access to attackers.

Bots dominate credential-stuffing attempts

Automated traffic is the primary engine behind the misuse of leaked credentials. The data shows that 95% of all login attempts using leaked passwords originate from bots, indicating that these requests are part of systematic credential-stuffing campaigns. Attackers assemble lists of usernames and passwords from breach dumps and test them across multiple services at scale, often rotating source IP addresses and mimicking human interaction patterns to evade detection.

The volume of these attacks remains persistently high across the Cloudflare network. When one account falls, the same credentials are immediately tried elsewhere, amplifying the blast radius of any single breach.

WordPress is a primary target

Content management systems are common targets for credential abuse because they are widely deployed and often rely on relatively simple authentication flows. WordPress, given its substantial market share, sees a disproportionate share of authentication traffic and automated attacks.

76% of login attempts using leaked passwords against WordPress sites are successful. That figure breaks down into two categories:

  • 48% of those successful logins are bot-driven, representing unauthorized automated access to accounts — frequently the first stage of an account takeover attack.
  • 52% come from legitimate users, meaning real account holders are signing in with credentials that have already been exposed elsewhere. This is notably higher than the 41% average seen across all platforms, underscoring how widespread password reuse is among WordPress site users.

Only 5% of leaked-password login attempts against WordPress are denied. That low denial rate suggests many sites lack basic protective measures such as rate-limiting or multi-factor authentication. Of those denied requests, 90% are bot-driven, indicating that while some defenses block automated logins, the vast majority of malicious attempts still find their way through.

The remaining 19% of login attempts fall into other categories — timeouts, incomplete authentication flows, or users who changed passwords mid-session — and do not register as either direct successes or denials.

Reducing the risk of compromised credentials

For individual users, the most immediate step is to stop reusing passwords. Every account should have a unique, strong password, and any service that supports multi-factor authentication should have it enabled. Passkeys offer a more secure, phishing-resistant alternative to traditional passwords where available.

For site owners, enabling leaked credential detection provides real-time monitoring and can trigger password reset flows when a match is found. Layering rate-limiting and bot management tools helps suppress automated credential-stuffing campaigns. Auditing existing password reuse patterns and identifying compromised credentials already present in the system, then enforcing robust password hygiene policies, closes the remaining gaps.