Credential stuffing uses stolen username-and-password pairs to gain unauthorised access. The cheat sheet below condenses the OWASP prevention guidance into a quick reference.
| Defence | Key points |
|---|---|
| Multi-factor authentication | The single most effective defence; where full MFA is impractical, apply it risk-based on suspicious logins. |
| Secondary passwords / PINs | Require an additional secret or security question for sensitive accounts. |
| CAPTCHA | Challenge suspicious login attempts to slow automated tools. |
| IP block-listing | Track and throttle or block IPs associated with malicious login attempts. |
| Device fingerprinting | Require additional verification when a login comes from an unrecognised device. |
| Unpredictable usernames | Avoid email addresses as the only identifier where possible, making pairs harder to reuse. |
| Multi-step login | Introduce steps that are harder for automated scripts to navigate. |
| Require JavaScript | Blocking non-JavaScript clients defeats many simple bots. |
| Identify leaked passwords | Check credentials against known-breached password lists and force a reset on a match. |
| Notify users | Alert users to suspicious activity and unrecognised logins so they can respond. |
Ready to strengthen your security?
Talk to our consultants about your penetration testing requirements, or get a fast, transparent quote.