Login pages attract constant automated attacks: credential stuffing, brute force and username enumeration. A few design decisions make the difference between a login page that holds and one that leaks.

How it happens

Weak password rules, no rate limiting, different error messages for "unknown user" and "wrong password", default credentials left in place, and password reset flows with predictable tokens all give attackers a way in.

Why it matters

• Account takeover at scale through credential stuffing.
• A list of valid usernames for targeted phishing.
• Full compromise through a default admin account.

How to prevent it

• Enforce a sensible minimum length and check passwords against known-breached lists.
• Rate-limit and add friction (such as lockouts or CAPTCHA) to repeated failures.
• Return the same message for unknown users and wrong passwords.
• Remove or change all default credentials.
• Use single-use, expiring password reset tokens, and offer multi-factor authentication.

How Vooki Pro helps

• Tests for default credentials, missing brute-force protection, user enumeration and weak password policy.
• Checks password reset flows and passwords returned in responses.
• Flags credentials in URLs and Basic authentication over plain HTTP.
• Detects exposed WordPress login pages and missing account lockout.

Frequently asked questions

What is user enumeration?

When a login or reset page responds differently for unknown users and wrong passwords, attackers can learn which usernames exist.

How do I stop credential stuffing?

Rate-limit logins, check passwords against breached lists, and offer multi-factor authentication.

Related: Session management best practices · Keeping third-party components up to date