![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Get started
- Concepts
- Traffic detections
- Overview
- Attack score
- Malicious uploads
- Bot score
- Threat intelligence
- Custom rules
- Overview
- Create in the dashboard
- Create via API
- Create using Terraform
- Configure a rule with the Skip action
- Common use cases
- Allow traffic from IP addresses in allowlist only
- Allow traffic from search engine bots
- Allow traffic from specific countries only
- Block Microsoft Exchange Autodiscover requests
- Block requests by attack score
- Block traffic by geographical location
- Block traffic from specific countries
- Build a sequence rule within custom rules
- Challenge bad bots
- Configure token authentication
- Exempt partners from Hotlink Protection
- Issue challenge for admin user in JWT claim based on attack score
- Require a specific cookie
- Require known IP addresses in site admin area
- Require specific HTTP headers
- Require specific HTTP ports
- Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
- Update custom rules for customers or partners
- Custom rulesets
- Managed rules
- Overview
- Deploy in the dashboard
- Deploy via API
- Deploy using Terraform
- Troubleshooting
- Create exceptions
- Log the payload of matched rules
- Additional tools
- Account-level configuration
- Overview
- Custom rulesets
- Rate limiting rulesets
- Analytics
- Security features interoperability
- Reference
- Alerts
- Phases
- Legacy features
- WAF managed rules (previous version)
- Rate Limiting (previous version)
- Firewall rules
- Firewall rules upgrade
- Glossary
- Home
- /WAF
- /…
- /Check for exposed credentials
- /How it works
How exposed credentials checks work
Deprecation notice
Exposed credentials check has been deprecated.
Switch from exposed credentials check to leaked credentials detection for improved security. To upgrade your current configuration, refer to the upgrade guide.
WAF rules can include a check for exposed credentials. When enabled in a given rule, exposed credentials checking happens when there is a match for the rule expression (that is, the rule expression evaluates to true).
At this point, the WAF looks up the username/password pair in the request against a database of publicly available stolen credentials. When both the rule expression and the exposed credentials check are true, there is a rule match, and Cloudflare performs the action configured in the rule.
For example, the following rule matches POST requests to the /login.php URI when Cloudflare identifies the submitted credentials as previously exposed:
Rule #1
Rule expression:
http.request.method == "POST" and http.request.uri == "/login.php"
Exposed credentials check with the following configuration:
- Username expression:
http.request.body.form["user_id"] - Password expression:
http.request.body.form["password"]
Action: Interactive Challenge
When there is a match for the rule above and Cloudflare detects exposed credentials, the WAF presents the user with a challenge.
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}