Access Dictionary
Session hijacking
Definition
Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
Also called: session hijack, cookie theft
Why it matters for WordPress
Admin cookies are powerful. XSS, malware on a workstation, or cleartext HTTP can expose them. After a hijack, the attacker does not need the password until the session ends. That is why HTTPS, XSS patching, and salt rotation after incidents matter together.
How it shows up in practice
- Actions in the events log while the real admin was asleep or offline
- Simultaneous sessions from distant locations
- Post-XSS cleanup that forgot to invalidate sessions
- Shared computers that still have a “remember me” admin cookie
What to do
- Serve the whole site over HTTPS.
- Patch XSS issues quickly.
- Log out shared computers; avoid “remember me” on untrusted devices.
- After a compromise, rotate passwords and invalidate sessions (regenerate salts if needed).
- Keep privileged accounts on 2FA so password reuse alone is not enough later.
Related terms
Nearby ideas in the dictionary
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- SSL/TLS SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- WordPress salts WordPress salts are secret keys in wp-config.php that help secure cookies, nonces, and related cryptographic operations.
