Password reuse is rampant: nearly half of observed user logins are compromised

Cloudflare reports that password reuse is fueling large-scale credential-stuffing: 41% of successful human logins and 52% of all authentication attempts involve leaked passwords, with 95% of leaked-password attempts driven by bots. WordPress sites are heavily targeted, where 76% of leaked-password login attempts succeed (48% bot-driven), while only 5% are denied. The report urges deploying MFA, rate limiting, bot management, and leaked-credential detection to mitigate account takeover risks.