Authdog
Console

Stop credential stuffing

Last updated Sep 9, 2026
View as Markdown

Blunt list-testing against your sign-in. Attackers replay stolen username/password pairs at scale; a CAPTCHA on sign-in plus two Lidar monitors makes the attempt expensive, surfaces it as a Signal, and keeps a real user's failed sign-in from looking like an attack.

What you use

  • Bot protection with an invisible challenge on signin: reCAPTCHA v3, or Cloudflare Turnstile Invisible. signin can render a checkbox, but a silent score is less disruptive for real users.
  • The Lidar brute_force monitor (detection:brute_force attempts:>100 window:5m), correlated by IP.
  • The Lidar credential_stuffing monitor (detection:credential_stuffing attempts:>200 window:15m), correlated across the environment.

Setup

  1. Add a reCAPTCHA v3 site or a Turnstile Invisible widget in the console under Authentication > Add-ons, and select the signin action.
  2. For reCAPTCHA, set the minimum score to 0.5 initially and require the echoed action to match signin so a token minted on another page cannot be replayed. For Turnstile, set widget mode to Invisible.
  3. Under Lidar > Monitors, enable brute_force and credential_stuffing. Tune attempts: and window: to your traffic shape; a busy environment needs higher floors than the defaults or every legitimate sign-in wave looks like an attack.

Do not enable both add-ons for signin. If you do, reCAPTCHA is used.

Verify

  • Replay a small list of bad credentials from one IP in dev: the invisible challenge drops automated attempts, brute_force fires on the IP, and credential_stuffing fires across the environment once the floor is crossed.
  • Confirm a real user with a wrong password does not raise a Signal; the monitors key on volume, not single failures.
  • Triage the resulting Signals in Lidar > Signals; the dedup keys keep re-analysis from creating duplicate alerts.

Learn more

Recipes

Prevent signup abuse

Stop MFA fatigue

Detect impossible travel