According to Cloudflare’s analysis of authentication traffic between September and November 2024, 41% of successful human login attempts involved compromised passwords, with bots driving 95% of these leaked credential login attempts. The research reveals that password reuse remains a critical security vulnerability, with attackers systematically exploiting stolen credentials across multiple platforms, particularly targeting Content Management Systems like WordPress. The numbers come from the leaked credentials detection that Cloudflare made available for free on all plans during its September 2024 Birthday Week, which checks login requests against a database of over 15 billion passwords, including the Have I Been Pwned dataset.
