19 Billion Passwords Are Already Stolen — Here’s How That Becomes a WordPress Hack
Researchers compiled a number in 2025 worth sitting with: 19,030,305,929 compromised passwords, pulled from more than 200 separate data breaches over a single year, according to Cybernews’ research. Nineteen billion. That figure alone explains why credential stuffing — trying stolen username-and-password pairs against login pages at massive scale — has become one of the most common ways any password-protected system gets broken into, WordPress very much included.
Why this attack works so well against WordPress specifically
Credential stuffing doesn’t need to guess your password. It already has real, working passwords — stolen from some other breach entirely, maybe a service you haven’t thought about in years — and it’s betting on something depressingly common: password reuse. Cybernews’ same research found that 94% of passwords currently in use are reused, duplicated, or dangerously weak, meaning only about 6% of passwords people actually use are genuinely unique to one account. If your WordPress admin password is the same one (or a close variant) you’ve used anywhere else that’s ever been breached, an attacker doesn’t need to hack WordPress at all — they just need that password to already be sitting in a leaked database somewhere.
The scale here is genuinely industrial. Credential stuffing accounts for roughly 22% of all data breaches, making it the single most common breach vector tracked in recent research, and attack volumes run into the tens of billions of login attempts monthly across the web. WordPress isn’t a side note in that picture — Wordfence’s own Q1 2026 threat report recorded more than 16 billion brute-force login attempts blocked across its network in a single quarter, alongside 9.1 billion malicious requests overall. The wp-login page is one of the most consistently hammered login surfaces on the internet, precisely because so many sites run it with default settings and no rate-limiting at all.
Why the success rate looks small — and why that doesn’t matter
Individually, credential stuffing is a low-odds attack: research puts the success rate at somewhere between 0.1% and 2% of attempts. That sounds almost reassuring until you do the math at scale — a 0.5% success rate against tens of millions of attempts is still tens of thousands of successful account takeovers. Attackers running this kind of attack aren’t hoping to get lucky on your site specifically; they’re running the same stolen credential list against millions of WordPress logins simultaneously, and your site only needs to be one of the ones where the reused password happens to match.
What actually stops this
Rate-limiting and lockouts on failed login attempts are the first real barrier — legitimate users rarely fail a login 20 times in a row, but an automated credential-stuffing script does exactly that by design, so throttling or temporarily blocking repeated failures closes off the attack’s basic mechanism. Two-factor authentication on every admin account matters even more, since it means a correct, stolen password alone isn’t enough to get in — and as covered in our WordPress passkeys guide, passkeys go a step further by removing the reusable password from the equation entirely, which is the only defense that fully closes the door credential stuffing depends on. IP reputation screening — blocking known data-center ranges, open proxies, and Tor exit nodes from hitting your login page — cuts out a meaningful share of automated attempts before they even get to guess anything. And disabling or restricting XML-RPC, which offers a separate, often-overlooked path for the same kind of automated login attempts, closes a door a lot of site owners don’t realize is open.
Why this is a layered problem, not a one-setting fix
No single defense here is complete on its own — rate-limiting alone can be worked around with distributed attempts across many IPs, 2FA alone doesn’t stop the initial flood of attempts hitting your server, and IP blocking alone won’t catch attackers using residential proxy networks that look like ordinary traffic. The sites that actually stay ahead of this combine several of these layers and keep watching for new patterns, since attackers adjust their approach as defenses improve. That kind of ongoing, adaptive protection — not a plugin installed once and forgotten — is exactly what our server and website protection and security monitoring services are built to provide.
FAQ
How do I know if my WordPress login has already been targeted by credential stuffing? Check your login attempt logs (many security plugins record this, or your host may show it) for large numbers of failed login attempts, especially from varied or unusual IP addresses in a short window. A pattern of many rapid, distinct login attempts is the signature of automated credential stuffing rather than a person mistyping their own password.
Is a strong, unique WordPress password enough protection on its own? It substantially reduces your risk, since credential stuffing specifically depends on password reuse — but it’s not complete protection on its own, since it doesn’t stop the attack traffic from hitting your server or protect against other login-security gaps like XML-RPC abuse. Pairing a unique password with 2FA or a passkey closes far more of the gap.
Can I check if my own password has been part of a known breach? Yes — breach-checking services exist specifically for this, letting you check whether an email address or password has appeared in a known leaked database. If it has, treat that password as compromised everywhere you’ve used it, not just on the one account tied to that breach.
