Access Dictionary
Session hijacking
Definition
Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
Also called: session hijack, cookie theft
Why it matters for WordPress
Admin cookies are powerful. XSS, malware on a workstation, or cleartext transport can expose them. After hijack, the attacker does not need the password until the session ends.
How it shows up in practice
- Actions in the events log while the real admin was offline
- Simultaneous sessions from distant locations
- Post-XSS cleanup that forgot to invalidate sessions
What to do
- Serve the whole site over HTTPS.
- Patch XSS issues quickly.
- Log out shared computers; avoid “remember me” on untrusted devices.
- After a compromise, rotate passwords and invalidate sessions (change salts if needed).
- Keep privileged accounts on 2FA so password reuse alone is not enough later.
Related terms
Nearby ideas in the dictionary
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- SSL/TLS SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.