What Cross-site request forgery (CSRF) means
CSRF abuses the trust a site has in a logged-in user. Well-built applications use tokens and cookie settings to block it. It is another reason to keep CMS core and plugins updated.
Why it matters for your website
A successful CSRF attack can make a logged-in admin change settings, add a user or make a purchase without realizing it. That can hand control of your site to an attacker. Well-built platforms include protections, which is one more reason to avoid outdated or poorly coded plugins.
Example
An attacker emails a store admin a link to a booby-trapped page. Because the store's admin forms check a security token, the forged request to create a new admin account is rejected.
Tips
- Keep your CMS, themes and plugins updated to get security fixes.
- Choose plugins from developers who maintain them actively.
- Log out of admin accounts when you are done, especially on shared devices.
Common mistakes
- Building custom forms that change data without checking a security token.
- Using admin accounts for everyday browsing while staying logged in.
Questions about Cross-site request forgery (CSRF)
What is Cross-site request forgery (CSRF)?
An attack that tricks a logged-in user's browser into making an unwanted request, like changing a setting.
How do websites prevent CSRF attacks?
Common defenses include unique tokens on forms, SameSite cookie settings and checking where requests come from. WordPress uses tokens called nonces for this purpose.
Is CSRF the same as cross-site scripting?
No. XSS injects malicious scripts into a page. CSRF tricks a user's browser into sending an unwanted request to a site where they are already logged in.
