SessionLatch ClickFix kit
SessionLatch is a gated script injector that can appear across several WordPress assets in one visit. We have matched it on 32 sites since 8 September.
SessionLatch in numbers
Since 8 September, the first SessionLatch match in our records, counted on 12 October 2026. How we count.
| Sites with SessionLatch code | 32 |
|---|---|
| Sites with a match in the last 30 days | 32 |
| New sites in September | 14 |
| Still serving it when recaptured at least 25 days later | 2 of 2 sites (100%) |
| Sites running WordPress (captured since 25 September) | 95% |
The same injector can ride several script responses
SessionLatch is our name for a compact block appended to otherwise legitimate JavaScript. Retained captures place it after theme and plugin code, at the end of a page document, or in both places during one visit. One capture contains the same block in nine separate WordPress script responses.
Each copy runs its own gates, but window.__rl records the decoded script URL. Once the first copy starts that load, later copies on the page stop before creating another script element.
Three gates narrow the visit
SessionLatch first checks for the WordPress admin bar. A logged-in administrator exits at that point. It then times a 20,000-iteration calculation and exits when the loop takes more than 120 milliseconds. The final gate looks for an http2_session_id cookie.
A visitor who passes those checks reaches a hand-written Base64 decoder named systemLoad. The decoded URL is assigned to an asynchronous script with a data-rl attribute and appended to the document. SessionLatch then writes http2_session_id=1 for 30 days.
The cookie is set immediately after the script element is appended. A failed network request still closes the gate for later page views in that browser. This order also explains why clearing the cookie matters during incident response.
What we see
| Month | New sites |
|---|---|
| September | 14 |
| October so far | 18 |
The persistence check found SessionLatch again on 2 of 2 sites recaptured at least 25 days after their first match (100%). 95% of SessionLatch sites captured since 25 September run WordPress.
SessionLatch overlaps with BW Panel on 18 sites and with LA02 on 10. Inspect every injected family found on an overlapping site.
Checking a WordPress site
Search page documents and the complete bodies of theme and plugin scripts for:
wpadminbarfollowed by an early return- a 20,000-iteration timing loop with a 120 ms cutoff
- the
http2_session_idcookie - a
systemLoaddecoder with its own Base64 alphabet window.__rland the script attributedata-rl
Test a logged-out browser after clearing site cookies. Compare the captured asset bodies with clean copies from the same plugin or theme version, and purge every cache layer that can retain the appended block.