內容簡介
Anti Session Hijacking 外掛旨在保護 WordPress 使用者的登入會話，防止會話劫持。它透過檢查每次請求的 IP 地址，確保只有原始登入的設備可以使用該會話，從而增強網站的安全性。
【主要功能】
• 驗證每次登入請求的客戶端 IP 地址
• 立即終止被劫持的會話並登出使用者
• 角色控制：對管理員和編輯者強制執行，對其他角色放寬限制
• 不匹配活動日誌顯示使用者和 IP 詳情
• 正確檢測反向代理和 CDN 背後的客戶端 IP
• 完全在自己的伺服器上運行，無需外部請求
外掛標籤
開發者團隊
原文外掛簡介
If someone steals a logged-in user’s session cookie, WordPress has no way of knowing. The cookie is valid, so the attacker is simply treated as that user — no password needed, and two-factor authentication never comes into play, because no new login ever happens.
Anti Session Hijacking closes that gap. It remembers the IP address each session was created from, checks it on every logged-in request, and immediately ends the session if the request comes from somewhere else. A stolen cookie stops working the moment it’s used from another machine.
How it works
WordPress core already records the IP address for every session token it issues at login. This plugin compares that recorded IP against the IP of each later request using the same session. On a mismatch it destroys that session token, clears the authentication cookie, and redirects the user to the login screen with an explanation. Other sessions belonging to the same user are left alone.
There is nothing to configure to get started — the check is active for every role as soon as you activate the plugin.
Features
Verifies the client IP on every logged-in request against the IP recorded when the session was created.
Immediately ends the hijacked session and signs the user out, without touching their other sessions.
Per-role control: enforce it for Administrators and Editors, relax it for roles that move between networks.
Mismatch Activity log showing the user, the login IP, the IP that triggered the mismatch, and when it happened.
Correct client IP detection behind a reverse proxy, load balancer, or CDN such as Cloudflare, using X-Forwarded-For — trusted only when the connection genuinely originates from a known proxy, so the header cannot be spoofed to bypass the check.
Runs entirely on your own server. No external requests, no third-party services, no accounts.
Lightweight: one comparison per request, no dashboard nags, no upsells.
Who it’s for
This suits sites where an administrator or editor account being taken over would be expensive: membership sites, WooCommerce stores, client sites, multi-author publications, and any site where staff log in over the public internet.
It pairs well with two-factor authentication. 2FA protects the moment of logging in; this protects the session that exists afterwards.
What this plugin does not do
Being clear about the limits, so it’s the right fit:
It does not block brute-force attacks or scan for malware — it only guards existing sessions.
It does not stop an attacker who is on the same IP address as the victim.
It cannot help if the site is served over plain HTTP, where cookies can be read in transit. Use HTTPS.
Users whose IP address legitimately changes mid-session — some mobile networks, some corporate proxies, some VPNs — will be signed out and need to log in again. The per-role setting exists for exactly this reason.
