Credential stuffing has overtaken classic brute-force guessing as the dominant WordPress login attack in 2026, and the reason is simple: billions of real, leaked username/password pairs from other services’ data breaches are freely available, and roughly 49% of a typical user’s passwords are reused across sites. Credential stuffing now accounts for roughly 19% of all authentication attempts industry-wide — and because it’s using real, previously-valid credentials rather than random guesses, it defeats defenses built purely around detecting rapid, repeated guessing.
Why This Is a Fundamentally Different Attack Than Classic Brute Force
Traditional brute-force protection (rate limiting, lockouts after N failed attempts) assumes an attacker is guessing blindly and can be slowed down by making guessing expensive. Credential stuffing doesn’t guess — it tests known-valid pairs from real breaches, and 2026’s versions are considerably more sophisticated than what the term evoked a decade ago: attacks now combine leaked credentials with AI-generated password candidates, and deliberately slow, low-volume attempts specifically designed to stay under rate-limiting thresholds rather than trigger them.
The Scale Involved
| Metric | Data |
|---|---|
| Password uniqueness across a typical user’s accounts | Only ~49% unique |
| Credential stuffing share of authentication attempts | ~19% |
| Historical scale (Wordfence, 2023) | 100+ billion credential-stuffing attempts blocked, from 74M+ unique IPs |
| Modern attack infrastructure | Botnets of tens of thousands to millions of compromised devices, each making just 1-2 attempts/minute per site |
| Potential match rate (before additional auth layers) | ~0.5% of attempts return a 200 response; true success drops below 0.02% with layered defenses |
Why the “Slow and Low” Pattern Specifically Defeats Basic Defenses
A botnet making one or two login attempts per minute, per compromised device, spread across tens of thousands of devices, produces an attack volume that’s individually invisible to standard rate-limiting (which is tuned to catch rapid attempts from a single source) while still generating enormous aggregate attempt volume against your login page. This is exactly why the last statistic above matters most: additional authentication layers — not just rate limiting — are what actually drive the real success rate down from a concerning 0.5% to a genuinely low 0.02%.
What Actually Works Against This
- Two-factor authentication is the single highest-leverage defense — a correct password alone is no longer sufficient for an attacker to gain access, which directly neutralizes the entire credential-stuffing model regardless of how the password was obtained.
- Passkeys go further still, since there’s no reusable password to have leaked from another breach in the first place — see our coverage of passkey adoption for WooCommerce specifically.
- Rate limiting still matters, but as a supplementary layer, not the primary defense — it catches naive, fast attacks while sophisticated slow-and-low campaigns require the additional-auth-layer approach to actually stop.
- Monitor login attempts for known-breached credential patterns where your security tooling supports it, rather than relying solely on attempt-frequency-based detection.
This connects directly to WordPress Two-Factor Authentication: A 2026 Setup Guide for Business Sites and WordPress Passkeys: Is Passwordless Login Ready for WooCommerce in 2026?. Want your site’s login security reviewed against modern credential-stuffing tactics? Get in touch.
Frequently Asked Questions
Does a strong, unique admin password protect against credential stuffing?
Yes, specifically — credential stuffing relies on reused passwords from other breaches, so a genuinely unique password for your WordPress admin account that’s never been used elsewhere isn’t vulnerable to this specific attack, though 2FA remains worth adding as a second layer regardless.
Is rate limiting still worth implementing if it doesn’t stop sophisticated attacks?
Yes — it still stops naive, high-volume attacks effectively; it’s simply not sufficient on its own against the slow-and-low botnet pattern that’s now common, which is why it should be paired with 2FA rather than relied on alone.
How can I tell if my site is actively being targeted by credential stuffing?
A security plugin logging failed login attempts by IP and pattern can reveal the telltale signs — many distinct IPs each making just one or two attempts, rather than one IP making many rapid attempts, which is the classic credential-stuffing signature versus traditional brute force.
Featured image: original illustration.