Stop Breached Passwords at the Door: DarkStrata Credential Check for Umbraco and Laravel

Why CMS and e-commerce platforms are the target

Content management systems and e-commerce platforms sit in an awkward spot. They are public by design, they hold accounts for large numbers of people, and they are usually run by a marketing or web team rather than a security team. Three kinds of login make them attractive:

• Customer and member accounts. A shop or membership site might hold thousands of logins, each attached to saved addresses, order history, loyalty points or stored payment methods. Attackers test breached password lists against these accounts at scale, a technique called credential stuffing, and cash out whatever they find.
• Editor and administrator accounts. A single backoffice login can publish content, upload files, change settings and add more users. If an editor reuses a password that leaked from a personal account, the whole site is one login away from defacement, malware injection or a redirect to a phishing page.
• Agency and freelancer accounts. Many CMS sites are built and maintained by third parties who hold logins across dozens of client sites. One compromised laptop can expose all of them.

The supply of stolen credentials feeding these attacks is enormous and constantly refreshed. Beyond old database dumps, a large share now comes from infostealer malware, which quietly lifts saved passwords from infected devices and sells them in bulk. We covered the e-commerce side of this in detail in our piece on January sales fraud. The short version: if a password has ever leaked, assume it is being tried against your site.

What the integrations do

Both hook into the three moments that matter and ask one question: is this email and password combination already known to be compromised?

• When someone sets or changes a password. If the new password is one that has already leaked alongside that email address, it is rejected with a clear message, the same way the platform already rejects a password that is too short. In Umbraco this happens automatically for members and backoffice users. In Laravel you add a NotCompromisedCredential rule to your registration, reset and change-password forms, next to the rules already there. Nobody can pick a known-bad password in the first place.
• When someone logs in. If a user signs in with a compromised pair, the login is refused. In Umbraco it looks like a wrong password, so the normal lockout rules apply and an attacker running a list gets locked out just as they would from guessing. In Laravel it surfaces as a validation error on the login form, so Breeze, Fortify, Jetstream and hand-written controllers show it without any extra work, and the attempt still counts towards your rate limiter. If you would rather observe before enforcing, a single setting switches either platform to warn-only mode.
• When you want to act on it. Every detection raises a standard Umbraco notification or a standard Laravel event, so your developers can email the security team, lock the account, or open a ticket with a few lines of code. Or ignore it and let the default behaviour do its job.

There is also a health check, in the Umbraco backoffice or as a php artisan darkstrata:check command, so you can see at a glance that the integration is configured and talking to DarkStrata.

No personal data leaves your server

The obvious worry with any "check this password" service is that you are sending passwords to someone else. These integrations do not. They use a privacy technique called k-anonymity: the email and password are hashed on your server, and only the first five characters of that hash are sent to DarkStrata. That fragment matches a large batch of possible results, which are returned to your server, and the final comparison happens locally. DarkStrata never sees the email, the username or the password, never sees the full hash, and cannot tell which result matched. The check is truly anonymous. It is the same approach that browsers and password managers use for their own breach warnings, and you can read more about it on our Credential Check API page.

Neither integration writes anything to your database, adds no screens or tables, and can be paused by blanking a single setting. If the DarkStrata service is ever unreachable, both fail open by default so your users are never locked out by a network problem.

Laravel developers may know the framework's built-in Password::uncompromised() rule, which asks Have I Been Pwned whether a password on its own has ever leaked. DarkStrata answers a sharper question: has this email and this password appeared together? That pairing is exactly what credential-stuffing bots type in, so it catches the attack without rejecting every common password your users happen to pick.

Why Umbraco and Laravel

Umbraco is one of the most widely used open-source content management systems in Europe, built on .NET, with a large community of agencies and in-house teams running everything from brochure sites to member portals and e-commerce stores. Laravel is the dominant PHP framework and sits behind a vast number of custom web applications, SaaS products and online shops, with a mature authentication layer that almost every Laravel site uses. Between them they cover a very large share of the login boxes on the business web.

Both are exactly the kind of platform where breached credentials do the most damage: many logins, a mix of public users and privileged administrators, and teams who want protection without becoming security specialists. Both also have clean extension points and a package ecosystem that expects open source. Our aim was an integration that a web developer can add in an afternoon and that a site owner never has to think about again.

Set up in three steps

The full guides are on the Umbraco and Laravel documentation pages, but in outline:

1. Add the package to your site, from NuGet for Umbraco or Packagist for Laravel.
2. Create an API key in your DarkStrata account with the Credential Check permission.
3. Give the key to your site through whatever configuration you already use, whether that is an environment variable, user secrets, a settings file or .env.

That is it for Umbraco, which supports versions 13, 15, 16 and 17. Laravel 11, 12 and 13 are supported, and the only code you write is adding the validation rule to your password forms. The same key works across as many sites as you run, so agencies can protect a whole client portfolio from one account.

Protecting whole ecosystems, not just one site

A plugin for one platform is useful. What we are really building is coverage for the places where people log in. The Credential Check behind this package is the same one available as an API and through open-source SDKs for Node.js, Python, Go, Java, Rust, PHP and .NET, so the same protection can sit inside a custom checkout, a mobile app's sign-up flow, or an internal portal. Alongside it, our integrations feed credential-exposure intelligence into the SIEM, SOAR and AI tooling that security teams already run.

Umbraco and Laravel came first because their ecosystems made it possible to deliver well: clean extension models, package registries, and communities that expect open source. If you run a different CMS, framework or commerce platform and would like the same one-install protection, we would like to hear from you.

Get started

Both integrations are free and open source under the Apache 2.0 licence. Checks against the DarkStrata breach corpus require a plan that includes Credential Check, and the key is created in the same place as any other DarkStrata integration.

• Read the Umbraco package or Laravel integration documentation
• Install from NuGet or Packagist
• Browse the source on GitHub
• Sign in to create an API key

Breached passwords are the easiest way into any site with a login box. Now they are the easiest thing to keep out of yours.