If someone steals a logged-in user’s session cookie, WordPress has no way of knowing. The cookie is valid, so the attacker is simply treated as that user — no password needed, and two-factor authentication never comes into play, because no new login ever happens.

Anti Session Hijacking closes that gap. It remembers the IP address each session was created from, checks it on every logged-in request, and immediately ends the session if the request comes from somewhere else. A stolen cookie stops working the moment it’s used from another machine.

How it works

WordPress core already records the IP address for every session token it issues at login. This plugin compares that recorded IP against the IP of each later request using the same session. On a mismatch it destroys that session token, clears the authentication cookie, and redirects the user to the login screen with an explanation. Other sessions belonging to the same user are left alone.

There is nothing to configure to get started — the check is active for every role as soon as you activate the plugin.

Features

Verifies the client IP on every logged-in request against the IP recorded when the session was created.
Immediately ends the hijacked session and signs the user out, without touching their other sessions.
Per-role control: enforce it for Administrators and Editors, relax it for roles that move between networks.
Mismatch Activity log showing the user, the login IP, the IP that triggered the mismatch, whether it came from the same browser, and what kind of request ended the session — enough to tell a colleague switching on a VPN apart from something worth investigating.
Correct client IP detection behind a reverse proxy, load balancer, or CDN such as Cloudflare, using X-Forwarded-For — trusted only when the connection genuinely originates from a known proxy, so the header cannot be spoofed to bypass the check.
Runs entirely on your own server. No external requests, no third-party services, no accounts.
Lightweight: one comparison per request, no dashboard nags, no upsells.

Who it’s for

This suits sites where an administrator or editor account being taken over would be expensive: membership sites, WooCommerce stores, client sites, multi-author publications, and any site where staff log in over the public internet.

It pairs well with two-factor authentication. 2FA protects the moment of logging in; this protects the session that exists afterwards.

What this plugin does not do

Being clear about the limits, so it’s the right fit:

It does not block brute-force attacks or scan for malware — it only guards existing sessions.
It does not stop an attacker who is on the same IP address as the victim.
It cannot help if the site is served over plain HTTP, where cookies can be read in transit. Use HTTPS.
Users whose IP address legitimately changes mid-session — some mobile networks, some corporate proxies, some VPNs — will be signed out and need to log in again. The per-role setting exists for exactly this reason.