WindCodex SwitchUser – User Switching and Login as Customer for WooCommerce

Yes – when done correctly. SwitchUser protects every switch action with WordPress nonces (CSRF protection), enforces role hierarchy so you can only switch into lower-privilege accounts, and stores the session in a signed HTTPOnly cookie that cannot be tampered with or replayed.

Never. SwitchUser switches your WordPress session without touching the login form. No passwords are read, stored, logged, or transmitted at any point.

By default, any user with the edit_users capability (typically Administrators). You can restrict this to specific roles – for example, allowing only Shop Managers to switch – from the Access Control settings.

No. SwitchUser automatically blocks switching into any account with equal or higher privilege than the switcher. The “Block switching into administrators” setting adds an explicit extra layer on top of this rule.

A Switch Back button is always shown in the WordPress admin bar during an active switch session. Click it to return instantly. You can also click Switch Off to end the session entirely.

SwitchUser is enabled by default after activation, enforces strict server-side role hierarchy checks, signs session cookies with HMAC (not plain database rows), protects every action with WordPress nonces, and integrates with WooCommerce order screens and an admin-bar quick-search switcher.

Yes. When WooCommerce is active, a Switch to Customer button appears on order edit screens, letting you jump into the customer’s account to reproduce checkout issues, verify order history, or check account details exactly as they see them.

Yes. The switch session is stored in a cookie with a configurable TTL (default 48 hours, adjustable from 1 to 168 hours). When the cookie expires, the session ends and you are returned to your original login state.

The switch session is stored in a persistent cookie (not a session cookie), so it survives browser restarts until the configured TTL expires. Once expired, you will need to log in again.

Yes. SwitchUser is fully compatible with WordPress multisite networks.

SwitchUser bypasses the login form entirely, so it works alongside most 2FA and membership plugins. If a plugin enforces its own session validation on every page load, there may be edge cases – check the plugin documentation or contact support.

The free version records basic switch activity in signed session cookies but does not include a persistent audit log. A full audit log with actor, target, IP, and timestamp is available in SwitchUser Pro.

In the free version, you can restrict who can perform switches by role. Per-user target grants – allowing only specific users to be switched into – are available in SwitchUser Pro.