Deep Dive Into Session Security

Deep Dive Into WordPress Session Management

Calvin Alkan @ snicco.io • 10 months ago

As shared here earlier, Thomas J. Raef recently released an analysis of hacked WordPress sites and found a significant number are hacked because session cookies were stolen due to the user’s computer having malware. One outcome from that research is the importance of logging out of sites and not just closing the browser.

In this article Calvin Alkan provides a deep dive into how WordPress sessions work. He found that WP session management provides good protection against Cross-Site Scripting attacks and session Fixation, but does not protect against session hijacking from local devices. Calvin’s suggestion is to decrease the lifetime of WordPress sessions to help prevent session hijacking.