Leaked passwords on WordPress: why login limits don't stop them, and what does

A guide for site and store owners. Updated October 17, 2026.

When another website gets breached, its users' email addresses and passwords end up on lists that get passed around. Plenty of people use the same password everywhere, so bots take those lists and try each email and password on other sites, yours included. It's called credential stuffing, and it's how a lot of WordPress admin and WooCommerce customer accounts get taken over.

Why login limits don't catch it

Login limits stop guessing: lots of wrong passwords from one place. Credential stuffing doesn't guess. It tries the one password that person used somewhere else, once, and moves on to the next account, often from a different address each time. When the password is right, it's right the first time, and nothing looks unusual.

Keep your login limits: they stop the guessing, which is still most of what bots do at a login. But the only way to stop a leaked password working is to know it's leaked.

Strength meters don't help here either

WordPress's password meter rates how hard a password would be to guess, and even then it lets people tick "Confirm use of weak password" and carry on. A password can look strong to a meter and still be on a breach list, because someone, somewhere, already used it. A meter can't know that.

Checking passwords against breaches, privately

Have I Been Pwned keeps a free list of passwords seen in real data breaches, with a way to check one without sending it anywhere:

1. Your site turns the password into a fingerprint (a SHA-1 hash).
2. It sends only the first 5 characters of that fingerprint.
3. The service answers with every leaked fingerprint that starts the same way, hundreds of them, padded with dummy entries so even the size of the answer gives nothing away.
4. Your site looks for the full fingerprint in that list itself.

Neither the password nor its full fingerprint ever leaves your site. NIST's password guidelines (SP 800-63B) tell sites to check new passwords against lists of compromised ones in just this way.

One catch: WordPress only stores passwords scrambled, so nobody can check the passwords your users already have. A check can only happen when someone types their password: when they sign up, change it, reset it, or log in.

What to do

1. Check your own passwords at haveibeenpwned.com, using the same private method, and change any that turn up. Start with every admin account.
2. Turn on two-factor login for admins. A leaked password alone then isn't enough.
3. Check passwords as people choose them, at signup, profile changes and password resets, and refuse ones that are on the list.
4. Check at login too, for the passwords people chose before you started checking, and ask anyone using a leaked one to change it.

WordPress doesn't do 3 or 4 by itself; they need a plugin.

How Ropeline Pro does it

Ropeline Pro checks passwords against Have I Been Pwned with the private method above, on every Pro plan:

• When a password is chosen: WordPress profile changes and password resets, WooCommerce signups (including accounts made at checkout) and WooCommerce's account details page. With the Leaked passwords setting on Refuse them (recommended), the person is told how many times that password has been seen in breaches and asked to pick another.
• At login on WordPress's and WooCommerce's login forms, at most once every 30 days per account: someone logging in with a leaked password can still get in, and is then shown a warning, in the WordPress dashboard or in their WooCommerce account, asking them to change it.
• Your weekly report says how many accounts still use a leaked password.
• If Have I Been Pwned can't be reached, the password is let through, so nobody is ever locked out by an outage.
• For its first 7 days Ropeline only records what it would have refused, so you can see it won't get in anyone's way.

The free plugin keeps doing what limits do best: locking out password guessers on every login door. See the login limits guide.

Questions

Does Ropeline see or keep my users' passwords?

No. The check happens inside WordPress, at the moment the password is typed. Only the first 5 characters of its fingerprint go to Have I Been Pwned, and nothing about the password is kept, only whether it was found and how many times.

What if a customer refuses to change a leaked password?

They can still log in and shop; they keep seeing the warning. Refusing leaked passwords only applies when a password is being chosen.

Can I only warn people, instead of refusing?

Yes: set Leaked passwords to Only warn, or Off.