About this plugin
CraftyTeam Login As User helps site administrators securely log in as another WordPress user or WooCommerce customer without asking for passwords.
The plugin adds a secure Login As User action to the WordPress Users screen, user profile screens, WooCommerce order screens, and WooCommerce order lists. After switching into a user account, the original administrator can return through a visible frontend panel or the WordPress admin bar.
Key features
- Login As User action for WordPress users.
- WooCommerce customer Login As User action from order screens and order lists.
- Secure return to the original administrator account.
- Local audit log under Users > Login As Audit.
- Signed session cookie and temporary transient-based session storage.
- Administrator and super administrator target accounts are blocked by default.
- No tracking, no third-party services, no external API calls.
- Conditional admin and frontend CSS loading.
Security model
Only logged-in users with both manage_options and edit_users can start a Login As User session. Switching to administrator or super administrator target accounts is blocked by default and can only be changed intentionally through filters.
The plugin uses WordPress nonces, capability checks, signed cookies, temporary transients, and safe redirect validation.
WooCommerce support
WooCommerce is optional. If WooCommerce is active, CraftyTeam Login As User adds customer Login As User actions to supported WooCommerce order screens. If WooCommerce is not active, the core WordPress user switching functionality continues to work.
Advanced Filters
Developers can customize selected behavior through these filters:
- ctm_login_as_session_duration – changes the temporary Login As session duration. Default: 12 hours.
- ctm_login_as_allow_admin_targets – allows administrator or super administrator target accounts when intentionally enabled. Default: false.
- ctm_login_as_target_can_be_switched – controls whether a specific target user can be accessed.
- ctm_login_as_default_redirect – changes the default redirect after switching into a user account.
- ctm_login_as_woocommerce_redirect – changes the redirect used by WooCommerce order actions.
- ctm_login_as_audit_limit – changes the number of local audit events stored. Default: 150.