![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Get started
- Concepts
- Traffic detections
- Overview
- Attack score
- Malicious uploads
- Bot score
- Threat intelligence
- Custom rules
- Overview
- Create in the dashboard
- Create via API
- Create using Terraform
- Configure a rule with the Skip action
- Common use cases
- Allow traffic from IP addresses in allowlist only
- Allow traffic from search engine bots
- Allow traffic from specific countries only
- Block Microsoft Exchange Autodiscover requests
- Block requests by attack score
- Block traffic by geographical location
- Block traffic from specific countries
- Build a sequence rule within custom rules
- Challenge bad bots
- Configure token authentication
- Exempt partners from Hotlink Protection
- Issue challenge for admin user in JWT claim based on attack score
- Require a specific cookie
- Require known IP addresses in site admin area
- Require specific HTTP headers
- Require specific HTTP ports
- Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
- Update custom rules for customers or partners
- Custom rulesets
- Managed rules
- Overview
- Deploy in the dashboard
- Deploy via API
- Deploy using Terraform
- Troubleshooting
- Create exceptions
- Log the payload of matched rules
- Additional tools
- Account-level configuration
- Overview
- Custom rulesets
- Rate limiting rulesets
- Analytics
- Security features interoperability
- Reference
- Alerts
- Phases
- Legacy features
- WAF managed rules (previous version)
- Rate Limiting (previous version)
- Firewall rules
- Firewall rules upgrade
- Glossary
- Home
- /WAF
- /…
- /Check for exposed credentials
- /Monitor exposed credentials events
Monitor exposed credentials events
Deprecation notice
Exposed credentials check has been deprecated.
Switch from exposed credentials check to leaked credentials detection for improved security. To upgrade your current configuration, refer to the upgrade guide.
Sampled logs in Security Events shows entries for requests with exposed credentials identified by rules with the Log action.
Check for exposed credentials events in the Security Events dashboard, filtering by a specific rule ID. For more information on filtering events, refer to Adjust displayed data.
Exposed credentials events are only logged after you activate the Exposed Credentials Check Managed Ruleset or create a custom rule checking for exposed credentials.
The log entries will not contain the values of the exposed credentials (username, email, or password). However, if matched payload logging is enabled, the log entries will contain the values of the fields in the rule expression that triggered the rule. These values might be the values of credential fields, depending on your rule configuration.
On this page
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}