Upgrade to leaked credentials detection

This guide describes the general steps to upgrade your Exposed Credentials Check configuration to the new leaked credentials detection.

Cloudflare recommends that customers update their configuration to use the new leaked credentials detection, which offers the following advantages:

• Uses a comprehensive database of leaked credentials, containing over 15 billion passwords.
• After enabling the detection, you can review the amount of incoming requests containing leaked credentials in Security Analytics, even before creating any mitigation rules.
• You can take action on the requests containing leaked credentials using WAF features like rate limiting rules or custom rules.

Note

This upgrade guide applies to customers changing from Exposed Credentials Check at the zone level.

1. Turn off Exposed Credentials Check

If you had deployed the Cloudflare Exposed Credentials Check managed ruleset:

1. Log in to the Cloudflare dashboard ↗, and select your account and domain.
2. Go to Security > WAF > Managed rules.
3. Under Managed rules, edit the rule that executes the Cloudflare Exposed Credentials Check Ruleset and take note of the current configuration (namely the performed action). Next, delete (or turn off) that rule.

Note

While Exposed Credentials Check and leaked credentials detection can work side by side, enabling both features will increase the latency on incoming requests related to authentication.

2. Turn on leaked credentials detection

On Free plans, the leaked credentials detection is enabled by default, and no action is required. On paid plans, you can turn on the detection in the Cloudflare dashboard or via API.

Dashboard

1. Log in to the Cloudflare dashboard ↗, and select your account and domain.
2. Go to Security > Settings.
3. Under Incoming traffic detections, turn on Leaked credentials.

API

Enable the feature using a POST request similar to the following:

curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/leaked-credential-checks" \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{ "enabled": true }'

3. Configure the actions to take

Based on your previous configuration, do one of the following:

• If you were using the default action in Exposed Credentials Check: Turn on the Add Leaked Credentials Checks Header managed transform that adds the Exposed-Credential-Check header to incoming requests containing leaked credentials. Even though the header name is the same as in Exposed Credentials Check, the header values in the new implementation will vary between 1 and 4.

• If you were using a different action: Create a custom rule with an action equivalent to the one you were using. The rule should match User and password leaked is true (if you are using the expression editor, enter (cf.waf.credential_check.username_and_password_leaked)).

---

More resources

• Check for the results of leaked credentials detection in Security Analytics.
• Refer to Mitigation examples for example mitigation strategies you can use when detecting leaked credentials.