Login as User or Customer — User Switching

Description

Login as User or Customer is a powerful user switching plugin that lets admins and support staff instantly switch into any user account — without knowing their password. It’s the fastest way to see exactly what your customer sees, troubleshoot issues, and provide hands-on support directly from your WordPress dashboard.

WooCommerce store owners: This plugin is purpose-built for you. Switch to a customer from the Orders screen, manage their cart, and create orders on their behalf — ideal for phone orders and assisted sales. WooCommerce features require the Pro version.

Who is this for?

• WooCommerce stores — assist customers with orders, cart issues, and account problems without asking for their password
• Membership sites — verify what members see after logging in
• Agencies & developers — test roles and permissions across any user account instantly
• Support teams — reproduce customer-reported bugs in one click

Free Features

• One-click user switching — switch to any non-admin account from the Users screen
• Switch from user profile — Login As button on the Edit User screen
• Go Back in one click — a persistent bar on the front end returns you to your original account instantly
• No password needed — access any account without exposing credentials
• Role-based access control — choose which roles are allowed to use the switch feature
• 2FA compatible — works alongside most two-factor authentication plugins
• Multisite compatible — works on WordPress network installations
• Nonce-protected — every switch action is verified with a WordPress nonce
• Secure session storage — switch state stored server-side using WordPress transients, not exposed cookies

Pro Features

• ⭐ WooCommerce Orders page — Login As button next to every order
• ⭐ WooCommerce Order detail — switch to the customer from the single order screen
• ⭐ Cart management — add, remove, and edit products in the customer’s cart
• ⭐ Create orders on behalf of customers — perfect for phone and assisted sales
• ⭐ Advanced role management — granular control over who can switch to whom
• ⭐ Custom redirect URL — choose where you land after switching
• ⭐ Activity log — track every switch action for auditing purposes
• ⭐ Shortcode support — place Login As buttons anywhere on your site

Upgrade to Pro →

How It Works

1. Go to Users in your WordPress admin
2. Click Login as this user next to any non-admin account
3. You are instantly switched into that account — no password required
4. Browse the site as that user
5. Click Go back in the bar at the bottom of the screen to return to your admin account

Security

Security is the foundation of this plugin. Every action is protected by multiple layers:

• Nonce verification on every switch and return action
• Capability checks — only users with edit_users, manage_options, or manage_woocommerce can switch
• Admin account protection — switching into administrator accounts is blocked
• Server-side session storage — switch state stored in WordPress transients with a 1-hour TTL that refreshes on every page load
• HttpOnly + SameSite=Lax cookies — session tokens protected against XSS and CSRF
• No data sharing — no data is sent to any external service

Security vulnerabilities are managed through the Patchstack Vulnerability Disclosure Program. All reported issues are reviewed, patched, and disclosed responsibly.

Privacy

This plugin does not send data to any third party, does not include any third-party resources, and never will.

The plugin uses a single browser cookie (loginas_session_token) to identify the current switch session. The cookie stores only a random 64-character token — no user data. The actual session data (user IDs) is stored server-side in WordPress transients.

Compatibility

• WordPress 5.0+
• WordPress Multisite
• WooCommerce (Pro)
• PHP 7.4, 8.0, 8.1, 8.2, 8.3
• Compatible with most 2FA and security plugins

Security

This plugin is enrolled in the Patchstack Vulnerability Disclosure Program.

To report a security vulnerability, please use the Patchstack mVDP link above. Do not report security issues through the WordPress support forum.