Documentation
SwitchUser
Security Model

Security Model

  1. Nonce verification - every Switch To, Switch Back and Switch Off action is protected by a WordPress nonce.
  2. Permission check - only users with edit_users (or an Allowed Switcher Role) can switch.
  3. Role hierarchy - administrators and equal-or-higher accounts can't be switched into. See Role Hierarchy.
  4. Signed cookie - your original account is remembered in an HMAC-SHA256 signed cookie, so it can't be forged to switch back into a different account.
  5. Expiry - switch sessions expire after the Session Duration (48 hours by default).
  6. Multisite-aware - users who are administrators on any site in the network are protected.
⚠️

Everyone allowed to switch can act as the users they switch into - including placing orders or changing account details. Only allow trusted roles, and keep the default (administrators only) unless you need more.

Switches are also written to the PHP error log (SwitchUser switch_to actor=… target=… ip=…). For a full audit log with CSV export, see SwitchUser Pro.

Switching BackChangelog