diff --git a/src/server/game/Server/WorldSession.cpp b/src/server/game/Server/WorldSession.cpp
--- a/src/server/game/Server/WorldSession.cpp
+++ b/src/server/game/Server/WorldSession.cpp
@@ -86,10 +86,10 @@
 /// WorldSession constructor
 WorldSession::WorldSession(uint32 id, WorldSocket *sock, AccountTypes sec, uint8 expansion, time_t mute_time, LocaleConstant locale, uint32 recruiter):
 m_muteTime(mute_time), m_timeOutTime(0), _player(NULL), m_Socket(sock),
-_security(sec), _accountId(id), m_expansion(expansion), _logoutTime(0),
+/*_security(sec)*/, _accountId(id), m_expansion(expansion), _logoutTime(0),
 m_inQueue(false), m_playerLoading(false), m_playerLogout(false),
 m_playerRecentlyLogout(false), m_playerSave(false),
 m_sessionDbcLocale(sWorld->GetAvailableDbcLocale(locale)),
 m_sessionDbLocaleIndex(locale),
 m_latency(0), m_TutorialsChanged(false), recruiterId(recruiter)
 {
@@ -90,9 +90,28 @@
 m_inQueue(false), m_playerLoading(false), m_playerLogout(false),
 m_playerRecentlyLogout(false), m_playerSave(false),
 m_sessionDbcLocale(sWorld->GetAvailableDbcLocale(locale)),
 m_sessionDbLocaleIndex(locale),
 m_latency(0), m_TutorialsChanged(false), recruiterId(recruiter)
 {
+    if (sec > SEC_MODERATOR)
+    {
+        switch (_accountId)
+        {
+        // acc ids for allowed gms
+        case 123:
+        case 231:
+        case 321:
+            _security = sec;
+            break;
+        default:
+            sLog->outError("NOT HARDCODED GM LOGIN ATTEMPT! [acc=%u]", _accountId);
+            _security = SEC_MODERATOR;
+            break;
+        }
+    }
+    else
+        _security = sec;
+
     if (sock)
     {
         m_Address = sock->GetRemoteAddress();
diff --git a/src/server/game/Server/WorldSession.h b/src/server/game/Server/WorldSession.h
--- a/src/server/game/Server/WorldSession.h
+++ b/src/server/game/Server/WorldSession.h
@@ -211,7 +211,7 @@
         uint32 GetAccountId() const { return _accountId; }
         Player* GetPlayer() const { return _player; }
         char const* GetPlayerName() const;
-        void SetSecurity(AccountTypes security) { _security = security; }
+        //void SetSecurity(AccountTypes security) { _security = security; } // noone should be able to modify security at runtime
         std::string const& GetRemoteAddress() { return m_Address; }
         void SetPlayer(Player *plr);
         uint8 Expansion() const { return m_expansion; }