Site takeover is when an attacker gains control of a website’s settings, content, or administrator-level functions. In practice, that can mean changing pages, creating new admin accounts, altering security settings, or redirecting visitors to malicious content.
It matters because takeover turns a vulnerability into full operational control. In WordPress and similar platforms, attackers often reach it through unauthenticated flaws, password-reset abuse, privilege escalation, or code execution in a plugin or theme. Once the attacker can act as an administrator, normal trust boundaries collapse and recovery becomes more difficult.