Every website with a login box has the same quiet problem. Somewhere in the world, a list exists with some of your users' email addresses and the passwords they use. Not because your site was breached, but because another site was, and people reuse passwords. Criminals know this, which is why the most common way into a content management system or online shop is not a clever exploit. It is a valid username and password, typed in by a bot, taken from a breach that happened somewhere else.
Today we are releasing the DarkStrata Credential Check package for Umbraco, a free, open-source plugin that closes that door. It stops compromised passwords from being set, and stops compromised logins from getting in, for both your site's members and the editors who work in the backoffice. It takes one install and one setting to switch on. This post explains why we built it, what it does in plain terms, and why Umbraco is the first of the platforms we are bringing this to.
Why CMS and e-commerce platforms are the target
Content management systems and e-commerce platforms sit in an awkward spot. They are public by design, they hold accounts for large numbers of people, and they are usually run by a marketing or web team rather than a security team. Three kinds of login make them attractive:
- Customer and member accounts. A shop or membership site might hold thousands of logins, each attached to saved addresses, order history, loyalty points or stored payment methods. Attackers test breached password lists against these accounts at scale, a technique called credential stuffing, and cash out whatever they find.
- Editor and administrator accounts. A single backoffice login can publish content, upload files, change settings and add more users. If an editor reuses a password that leaked from a personal account, the whole site is one login away from defacement, malware injection or a redirect to a phishing page.
- Agency and freelancer accounts. Many CMS sites are built and maintained by third parties who hold logins across dozens of client sites. One compromised laptop can expose all of them.
The supply of stolen credentials feeding these attacks is enormous and constantly refreshed. Beyond old database dumps, a large share now comes from infostealer malware, which quietly lifts saved passwords from infected devices and sells them in bulk. We covered the e-commerce side of this in detail in our piece on January sales fraud. The short version: if a password has ever leaked, assume it is being tried against your site.
What the plugin does
The package hooks into the three moments that matter and asks one question: is this email and password combination already known to be compromised?
- When someone sets or changes a password. If the new password is one that has already leaked alongside that email address, it is rejected with a clear message, the same way Umbraco already rejects a password that is too short. Nobody can pick a known-bad password in the first place.
- When someone logs in. If a member or backoffice user signs in with a compromised pair, the login is refused as if the password were wrong. Because it looks like a wrong password, Umbraco's normal lockout rules apply and an attacker running a list gets locked out just as they would from guessing. If you would rather observe before enforcing, a single setting switches this to warn-only mode.
- When you want to act on it. Every detection raises a standard Umbraco notification, so your developers can email the security team, lock the account, or open a ticket with a few lines of code. Or ignore it and let the default behaviour do its job.
There is also a health check in the backoffice so you can see at a glance that the package is configured and talking to DarkStrata.
Passwords never leave your server
The obvious worry with any "check this password" service is that you are sending passwords to someone else. This package does not. It uses a privacy technique called k-anonymity: the email and password are hashed on your server, and only the first five characters of that hash are sent to DarkStrata. That fragment matches a large batch of possible results, which are returned to your server, and the final comparison happens locally. DarkStrata never sees the password, never sees the full hash, and cannot tell which result matched. It is the same approach that browsers and password managers use for their own breach warnings, and you can read more about it on our Credential Check API page.
The package writes nothing to your Umbraco database, adds no content types or backoffice screens, and can be paused by blanking a single setting. If the DarkStrata service is ever unreachable, it fails open by default so your users are never locked out by a network problem.
Why Umbraco first
Umbraco is one of the most widely used open-source content management systems in Europe, with a large community of agencies and in-house teams running everything from brochure sites to member portals and e-commerce stores. It is built on .NET, which is the stack behind a huge share of business web applications, and it has a healthy package ecosystem with a marketplace that makes adding capability straightforward.
It is also exactly the kind of platform where breached credentials do the most damage: many logins, a mix of public members and privileged editors, and teams who want protection without becoming security specialists. Our aim was a package that a web developer can add in an afternoon and that a site owner never has to think about again.
Set up in three steps
You do not need to write any code. The full guide is on the Umbraco package documentation page, but in outline:
- Add the package to your site from NuGet.
- Create an API key in your DarkStrata account with the Credential Check permission.
- Give the key to your site through whatever configuration you already use, whether that is an environment variable, user secrets or a settings file.
That is it. The package supports Umbraco 13, 15, 16 and 17, and the same key works across as many sites as you run, so agencies can protect a whole client portfolio from one account.
Protecting whole ecosystems, not just one site
A plugin for one CMS is useful. What we are really building is coverage for the places where people log in. The Credential Check behind this package is the same one available as an API and through open-source SDKs for Node.js, Python, Go, Java, Rust and .NET, so the same protection can sit inside a custom checkout, a mobile app's sign-up flow, or an internal portal. Alongside it, our integrations feed credential-exposure intelligence into the SIEM, SOAR and AI tooling that security teams already run.
Umbraco is the first platform package because its ecosystem made it possible to deliver well: a clean extension model, a package marketplace, and a community that expects open source. If you run a different CMS or commerce platform and would like the same one-install protection, we would like to hear from you.
Get started
The package is free and open source under the Apache 2.0 licence. Checks against the DarkStrata breach corpus require a plan that includes Credential Check, and the key is created in the same place as any other DarkStrata integration.
- Read the Umbraco package documentation
- Install from NuGet
- Browse the source on GitHub
- Sign in to create an API key
Breached passwords are the easiest way into any site with a login box. Now they are the easiest thing to keep out of yours.