Brute Force Protection Check: What StackShield Tests

What this check looks for

StackShield probes your authentication endpoints the way an attacker's tooling would: it sends repeated requests to login, password-reset and token routes and watches how the application responds. It is reading one signal above all, whether the endpoint throttles or answers every attempt at full speed.

An endpoint that keeps returning 200 or 422 without ever issuing a 429 Too Many Requests is telling automated tooling that it can keep guessing indefinitely.

Why it matters

Credential stuffing is one of the most common attacks on any application with a login. Attackers replay lists of username and password pairs leaked from other breaches, millions of them, against your login form. If any of your users reused a password, that account is taken over. Without a rate limit there is no cost to trying, so the attack runs until it succeeds.

The same applies to password-reset and one-time-code endpoints, where an unthrottled route lets an attacker brute force a short code or enumerate which email addresses have accounts.

What a failed check means

A failed check means at least one authentication-adjacent endpoint accepted a burst of requests without throttling. It does not mean you have been breached; it means the door has no lock on how many times it can be tried. That is the precondition every credential-stuffing and code-guessing attack depends on.

The fix is Laravel's rate limiter applied to the right routes, keyed by user or IP, so the endpoint returns 429 once a threshold is crossed.

See the step-by-step remediation: how to fix this.