What Session hijacking means
Stolen session cookies can bypass passwords and even some MFA. HTTPS everywhere, secure cookie settings and short sessions for admin accounts reduce the risk. Malware on staff devices is a common source.
Why it matters for your website
A stolen session lets an attacker skip the password and even some login checks, so they can change your site, read customer data or make purchases as you. Protecting sessions keeps both your admin area and your customers' accounts safe.
Example
A shop owner logs into the store admin on café Wi-Fi, and malware on the laptop copies the session cookie, letting an attacker into the dashboard without the password.
Tips
- Use HTTPS everywhere and mark login cookies as Secure and HttpOnly.
- Log out of admin panels on shared or public computers.
- Set sessions to expire after inactivity and on password changes.
Common mistakes
- Keeping admin users logged in forever on every device.
- Installing browser extensions from unknown sources on computers used for site admin.
Questions about Session hijacking
What is Session hijacking?
Stealing a user's login session so an attacker can act as them without a password.
Does two-factor authentication stop session hijacking?
Not fully. 2FA protects the login step, but if an attacker steals a session that is already logged in, they may get in without it. Short session times and good device security help close that gap.
How can I tell if my session was hijacked?
Signs include changes you did not make, unfamiliar login locations or devices in your account history, and being logged out unexpectedly. Sign out all sessions and change your password if you suspect it.
