---
title: Account takeover
canonical: https://wpsecurityninja.com/dictionary/account-takeover/
---
# Account takeover

Account takeover is when an attacker gains control of a legitimate user account and can act as that user.

[Full guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/)

## FAQ

### Is account takeover the same as a brute-force attack?

No. Brute force is one way in: guessing until a password works. Account takeover is the outcome, someone controlling a real user account. It can also come from phishing, credential stuffing, or stolen session cookies, sometimes with almost no failed logins in the log.

### What should I do first if an admin account is taken over?

Regain clean access, rotate that user’s password, invalidate sessions (regenerate salts if needed), turn on 2FA, then audit users, plugins, and files for what the attacker did after login.

## Why it matters for WordPress

If an Administrator account is taken over, the attacker can install plugins, create more admins, and plant backdoors. Takeover often starts with a reused password, a phishing page, or a session theft, not a clever zero-day.

## How it shows up in practice

- Successful login from a country or device nobody recognizes
- Password changed out from under the real owner
- New Administrator users appearing after a quiet login
- Email forwarding or notification settings altered to hide alerts

## What to do

1. Require unique passwords and 2FA on privileged roles before you need them.
2. Rate-limit login failures and review unusual successes.
3. If takeover is suspected, rotate passwords, revoke sessions/salts, and audit users and plugins.
4. Check the events log for the first odd success and everything after it.

## In WP Security Ninja

[Login protection](https://wpsecurityninja.com/login-protection/) slows guessing and stuffing noise. [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/) blocks many takeovers even when the password is already known. The [Events Logger](https://wpsecurityninja.com/events-logger/) helps you see the surprise success and the admin creates that follow.