Anti Session Hijacking
| 开发者 | martinvw82 |
|---|---|
| 更新时间 | 2026年8月3日 05:09 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Verifies the client IP on every logged-in request against the IP recorded when the session was created.
- Immediately ends the hijacked session and signs the user out, without touching their other sessions.
- Per-role control: enforce it for Administrators and Editors, relax it for roles that move between networks.
- Mismatch Activity log showing the user, the login IP, the IP that triggered the mismatch, and when it happened.
- Correct client IP detection behind a reverse proxy, load balancer, or CDN such as Cloudflare, using X-Forwarded-For — trusted only when the connection genuinely originates from a known proxy, so the header cannot be spoofed to bypass the check.
- Runs entirely on your own server. No external requests, no third-party services, no accounts.
- Lightweight: one comparison per request, no dashboard nags, no upsells.
- It does not block brute-force attacks or scan for malware — it only guards existing sessions.
- It does not stop an attacker who is on the same IP address as the victim.
- It cannot help if the site is served over plain HTTP, where cookies can be read in transit. Use HTTPS.
- Users whose IP address legitimately changes mid-session — some mobile networks, some corporate proxies, some VPNs — will be signed out and need to log in again. The per-role setting exists for exactly this reason.
安装:
- Upload the
anti-session-hijackingfolder to the/wp-content/plugins/directory, or install the plugin through the Add Plugins screen in WordPress. - Activate the plugin through the 'Plugins' screen in WordPress.
- That's it — the check is immediately active for all roles. To adjust which roles it applies to, go to Settings → Anti Session Hijacking.
屏幕截图:
常见问题:
Will this sign out users whose IP address changes for legitimate reasons?
Yes, and this is the main trade-off to be aware of. Some mobile carriers, corporate proxies, and VPNs rotate a user's IP address mid-session, which is indistinguishable from a hijack as far as the check is concerned. If this is disruptive for a particular group of users, turn the check off for their role under Settings → Anti Session Hijacking. Administrator accounts are usually worth keeping strict.
Does it work behind Cloudflare, a load balancer, or a reverse proxy?
Yes. Behind a proxy, every request appears to come from the proxy's own address, which would make the check useless. The plugin reads the real visitor IP from the X-Forwarded-For header instead — but only when the request genuinely arrives from a proxy address, so an attacker cannot simply send that header themselves to defeat the check. The trusted proxy ranges default to the usual private networks and can be adjusted with the antisehi_trusted_proxies filter.
Does this replace two-factor authentication?
No, it complements it. Two-factor authentication protects the act of logging in. It does nothing once a session already exists, which is precisely when a stolen cookie is used. Running both covers the login and the session that follows.
Does this plugin send any data outside of my site?
No. Every check happens locally, using data WordPress already stores for the current session. There are no external requests, no telemetry, and no third-party services involved.
Does this plugin create any new database tables?
Yes, one: a mismatch log recording the username, the IP the session logged in with, the IP that triggered the mismatch, and a timestamp, each time a user is signed out by this plugin. It's viewable under Settings → Anti Session Hijacking → Mismatch Activity. Nothing in it ever leaves your site, and the table — along with the plugin's settings — is removed automatically when you uninstall the plugin.
Does it store personal data, and what about GDPR?
The mismatch log stores usernames and IP addresses, and IP addresses are considered personal data under the GDPR. They are stored only on your own server, only when a mismatch actually occurs, and are deleted entirely when you uninstall the plugin. If you keep a privacy policy listing what your site records, it's worth mentioning this log.
Does this plugin update itself automatically?
Yes. When you activate it, it switches on WordPress's own automatic updates for this plugin, so security fixes reach your site without waiting for someone to log in and press update. This is a security plugin, and an out-of-date one protects nobody. It uses the same setting as the Automatic Updates column on your Plugins screen, so nothing is hidden from you: the screen will show auto-updates as enabled, and you can switch them off there exactly like any other plugin. If you do switch them off, that choice sticks — deactivating and reactivating the plugin will not quietly turn them back on. Uninstalling removes the plugin from that list entirely.
Will it sign out all of a user's devices?
No. Only the specific session that failed the check is destroyed. If the same user is logged in on a phone and a laptop, ending the hijacked session leaves the other one signed in.
更新日志:
- Fixed: activating the plugin on a site behind a reverse proxy or CDN signed every logged-in user out and recorded a false entry in the Mismatch Activity log. Sessions created before activation carried the IP that WordPress core records (the proxy's address), which the plugin then compared against the real visitor address it resolves itself — a guaranteed mismatch that was never an actual hijack.
- The plugin now records and compares its own IP value instead of reusing the one written by WordPress core, so the two can no longer disagree. A session first seen after upgrading is adopted at its current address and guarded from that point on, which means upgrading to this version does not sign anyone out either.
- Automatic updates for this plugin are now switched on when it is activated, so security fixes arrive without waiting for a manual update. It uses WordPress's own per-plugin setting, stays visible in the Automatic Updates column on the Plugins screen, and can be turned off there at any time.
- Added translations for Dutch, German, French, and Spanish.
- Added a translation template (.pot) so the plugin can be translated into further languages.
- Renamed all internal classes, functions, options, and hooks to a unique
ANTISEHIprefix to avoid any chance of collisions with other plugins.
- Added the Mismatch Activity log (user, login IP, request IP, date) under Settings → Anti Session Hijacking.
- Added correct client IP detection behind a trusted reverse proxy or CDN via X-Forwarded-For, so the check keeps working on proxied sites instead of silently never triggering.
- Fixed a duplicate "Settings saved." notice on the settings screen.
- Initial release: compares the request IP against the login IP for the active session and signs the user out on a mismatch, with per-role enable/disable settings.