Credential stuffing uses username and password pairs from other services against yours, betting on reuse. The security consequence is account takeover. The operational consequence arrives first: a login endpoint is one of the most expensive routes in any application, and attackers request it thousands of times per minute.
Why Login Endpoints Are Expensive
A correctly built login does deliberately slow work. Password hashing is designed to cost measurable time — that is what makes stolen hashes hard to crack. Add a database lookup, a session write, and an audit log entry, and a single attempt can cost more than serving an entire cached page. An attacker replaying a leaked list is, without intending to, running a resource exhaustion attack.
Order of operations
Rate limiting must run before password verification. If the limit is checked after hashing, the expensive work has already been done and the limiter protects your accounts while doing nothing for your server.
Layered Defence
- Two rate limit buckets: one per source address, and one per account name. The first catches a single noisy client, the second catches a botnet grinding one inbox.
- A browser challenge in front of the form during an attack, so clients that cannot execute JavaScript never reach the handler.
- Second factors, which turn a correct password into an incomplete login.
- Breached password checks at registration and change time, so reused credentials never become valid in the first place.
- Consistent responses and timing, so the form does not reveal which usernames exist.
Do Not Lock the Account
Locking an account after a few failures sounds protective and hands the attacker a denial-of-service tool: anyone can lock out any user by guessing badly on purpose. Throttling the attempt is the better primitive — it slows the attacker without letting them take a legitimate user offline.
Watch the Right Signal
Total login attempts are noisy. The number that reveals credential stuffing is the failure ratio: normal populations fail a minority of the time, and a stuffing run fails almost always. A sudden move from a low failure rate to a very high one, with volume rising at the same time, is the clearest early warning you will get.