Account takeover
Definition
Account takeover is when an attacker gains control of a legitimate user account and can act as that user.
Also called: ATO, account takeover attack, compromised admin
Why it matters for WordPress
If an Administrator account is taken over, the attacker can install plugins, create more admins, and plant backdoors. Takeover often starts with a reused password, a phishing page, or a session theft, not a clever zero-day.
How it shows up in practice
- Successful login from a country or device nobody recognizes
- Password changed out from under the real owner
- New Administrator users appearing after a quiet login
- Email forwarding or notification settings altered to hide alerts
What to do
- Require unique passwords and 2FA on privileged roles before you need them.
- Rate-limit login failures and review unusual successes.
- If takeover is suspected, rotate passwords, revoke sessions/salts, and audit users and plugins.
- Check the events log for the first odd success and everything after it.
In WP Security Ninja
Login protection slows guessing and stuffing noise. 2FA blocks many takeovers even when the password is already known. The Events Logger helps you see the surprise success and the admin creates that follow.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Phishing Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Session hijacking Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.