---
title: Session hijacking
canonical: https://wpsecurityninja.com/dictionary/session-hijacking/
---
# Session hijacking

Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.

Last updated: 2026-08-26

Also called: session hijack, cookie theft

## Related terms

- [Cross-site scripting (XSS)](https://wpsecurityninja.com/dictionary/xss/): Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- [SSL/TLS](https://wpsecurityninja.com/dictionary/ssl-tls/): SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
- [Two-factor authentication (2FA)](https://wpsecurityninja.com/dictionary/two-factor-authentication/): Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- [WordPress salts](https://wpsecurityninja.com/dictionary/wordpress-salts/): WordPress salts are secret keys in wp-config.php that help secure cookies, nonces, and related cryptographic operations.

## Why it matters for WordPress

Admin cookies are powerful. XSS, malware on a workstation, or cleartext HTTP can expose them. After a hijack, the attacker does not need the password until the session ends. That is why HTTPS, XSS patching, and salt rotation after incidents matter together.

## How it shows up in practice

- Actions in the events log while the real admin was asleep or offline
- Simultaneous sessions from distant locations
- Post-XSS cleanup that forgot to invalidate sessions
- Shared computers that still have a “remember me” admin cookie

## What to do

1. Serve the whole site over HTTPS.
2. Patch XSS issues quickly.
3. Log out shared computers; avoid “remember me” on untrusted devices.
4. After a compromise, rotate passwords and invalidate sessions (regenerate salts if needed).
5. Keep privileged accounts on 2FA so password reuse alone is not enough later.