During the talk I covered how WordPress authentication cookies and session tokens actually work, the different ways sessions get hijacked, and, the part most WordPress security setups miss entirely; post login security. In other words, what to do about visibility and control after someone is already logged in.

Below you’ll find the plugins that add the specific capabilities highlighted during the talk, the reports and data cited during the talk, and some further reading if you want to go deeper on any of it.

Plugins mentioned in this talk

The talk touches several distinct capabilities, which are; activity logging, session visibility, account lifecycle management, device recognition, and user roles. A plugin covering more than one is only listed once below, with all relevant capabilities noted alongside it.

No free plugin covers real-time session visibility or concurrent session limits in full. That’s a genuine gap in the free plugin space.

Reports & research referenced in this talk

Security awareness training

Technical controls only go so far, and the talk closes on the human layer. A couple of starting points if you want to build this out for your team or clients:

Further reading