FAQ
Is the audit log tamper-proof?
No. It's stored in a WordPress database table, so someone with database access could change it. For a tamper-proof trail, send the switchuser_switched and switchuser_switched_back actions to an external log service.
Does the audit log show what I did while switched?
Yes. Besides switches and switch-backs, it records every page you open while switched, products added to the cart and orders placed.
Is the user notified when someone switches into their account?
No. Per-switch emails go to the Notification Email Address (for example your security team), not to the switched-into user.
Can I let a support agent switch into only their own customers?
Yes. Allow the agent's role under Allowed Switcher Roles, then on the agent's profile set This user can switch only to to their customers' IDs. See User Grants.
Does the idle timeout switch me back while the tab is just open?
No. It's checked when you load a page. If you've been inactive longer than the timeout, the next page load switches you back.
What if the weekly digest isn't sent?
It relies on WordPress cron. If wp-cron is disabled and no server cron runs, it won't send. Check with WP Crontrol that switchuser_weekly_digest is scheduled.
Can the IP allowlist use ranges?
Yes. Enter single IPs or CIDR ranges - IPv4 like 203.0.113.0/24 or IPv6 like 2001:db8::/32 - one per line or comma-separated. See IP Allowlist.