---
title: Session hijacking
canonical: https://wpsecurityninja.com/dictionary/session-hijacking/
---
# Session hijacking

Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.

## Why it matters for WordPress

Admin cookies are powerful. XSS, malware on a workstation, or cleartext HTTP can expose them. After a hijack, the attacker does not need the password until the session ends. That is why HTTPS, XSS patching, and salt rotation after incidents matter together.

## How it shows up in practice

- Actions in the events log while the real admin was asleep or offline
- Simultaneous sessions from distant locations
- Post-XSS cleanup that forgot to invalidate sessions
- Shared computers that still have a “remember me” admin cookie

## What to do

1. Serve the whole site over HTTPS.
2. Patch XSS issues quickly.
3. Log out shared computers; avoid “remember me” on untrusted devices.
4. After a compromise, rotate passwords and invalidate sessions (regenerate salts if needed).
5. Keep privileged accounts on 2FA so password reuse alone is not enough later.