The Dumb Password Report for June 2025

by Alan Langford | 2025-07-03 | It's a Code, Code World

No changes for the June 2025 slightly scary dumb password report. Most notable this month is a sharp drop in access attempts, just 24% of the volume in May, although the diversity of passwords has only dropped to 64% of last month. This corresponds with my theory that spikes in December and April/May correspond to bored university students with nothing better to do than turn into script kiddies and try to wreak a little havoc. This theory has nothing to do with my personal experience as a bored university student. [cough]

I’ve replaced valid login user names with {username}, and names of the site with {site}, old compromised passwords with {compromised} and malware with {malware}. There were also a large number of seemingly random hex strings logged on one site. They’re pretty boring so I’ve collected those as one entry. If you think your username followed by a special character and a year is a secure password, you might be in for a shock. Actually, your user/site name followed by anything is a really bad idea.

These are failed password attempts across my WordPress websites. None of my sites are particularly popular. The amount of real traffic they get is small. So if you have a site and think hackers are ignoring it because few would care, think again. Every site on the net gets attacked like this. Every single one, including yours!

The data is presented in two ways, by frequency and in alphabetical order.

1367 login attempts with 303 different passwords

Back to frequency order.

Frequency table Alphabetical table