Credential stuffing is an automated attack that tries leaked email/password pairs from other sites against yours. It is not brute force (guessing Password1). It works because people reuse logins.

Bots hit /login from many IPs, under rate-limit radar, looking like shoppers. A WAF and rate limits slow them; CAPTCHA and two-factor authentication stop a match from becoming a session. Passkeys remove the reusable secret. HTTPS encrypts the trip; it does not stop a password that already leaked elsewhere.

A real-life example of credential stuffing

A Decatur boutique customer used the same password on an old forum that got dumped. Overnight, bots try that email on the store login, Gmail, and Shopify. One hit without 2FA is an account takeover — refunds, gift cards, a mess. The shop didn’t get “hacked” in a movie sense; reused credentials walked in the front door.

Throttle logins, challenge bots, force 2FA on admin. Tactics: Cloudflare against credential stuffing and 5 rapid actions.