Imagine someone can access your WordPress dashboard without guessing your password, getting past your two-factor authentication (2FA), or bypassing your firewall. How can this happen? By reusing a session that is already logged in (session hijacking), attackers can impersonate you.
Once you log in, WordPress trusts the authentication cookies stored in your browser. Therefore whoever holds those cookies, or can trick your browser into sending them, is treated as you.
In this talk, I explain how WordPress authentication and sessions work: the authentication cookies, the session tokens, and the checks WordPress runs on every request. I then walk through the most common ways that lead to sessions getting compromised, from shared accounts and public Wi-Fi, to adversary-in-the-middle phishing, vulnerable plugins, and cross-site request forgery (CSRF).
Most WordPress security efforts go into hardening the website, which focus on what happens before a user logs in. That’s all good, but, what security measures do you have in place for when a user is locked in? So I close this talk with a number of practical ways to add that missing post-login security layer; using activity logs, session policies, user account management, device recognition, and user education.
From this talk you’ll come away knowing how to see who is logged in, limit what a hijacked session can do, what tools you have available to better manage user sessions, and how to spot suspicious activity early.
This presentation was given at:
- Nijmegen WordPress meetup – July 2026
- WordCamp US – August 2026
- Vienna WordPress meetup – September 2026
Slides & links
- Download the slide deck for this presentation
- Watch the presentation on WordPress.tv or YouTube.
- Visit the talk’s landing page for a complete list of plugins, the mentioned reports, and links to articles about WordPress security and session hijacking.
References
During the talk I mention a number of WordPress plugins you can use to keep a log of changes that happen on your website, to see who is logged in to your website in realtime, and also plugins that allow you to enforce certain login and session policies, and more. Some of these plugins are developed by Melapress. These are:
- WP Activity Log: this plugin allows you to keep an activity log, configure email, SMS and other type of instant alerts, see who is logged in to your website in real time, and manage user sessions.
- Melapress Login Security: this plugin allows you to configure a number of login and session policies, to configure user sessions properties (such as duration), set up user notifications, and create temporary secure logins for third parties.