Description
Dalmatian Dream Login As User adds a secure “Login as user” action to the WordPress Users screen for administrators with the dedicated dd_switch_users capability.
The plugin uses opaque per-session switch tokens, server-side transient state, nonce-protected switch and return actions, strict target validation, safe redirects, and cleanup on logout. It blocks nested impersonation and protects multisite super administrator accounts.
The plugin does not send data to external services and does not include telemetry, advertising, or remote code.
Privacy
Dalmatian Dream Login As User does not transmit personal data to external services. Switch-session state is stored temporarily in the local WordPress database using transients and is removed when the session expires, the user returns to the administrator account, or the impersonated user logs out.
Installation
- Upload the
dd-login-as-userfolder to/wp-content/plugins/. - Activate the plugin through the Plugins screen in WordPress.
- Administrators receive the
dd_switch_userscapability on activation.
FAQ
-
Who can switch users?
-
Only users with the
dd_switch_userscapability can start a switch session. The plugin adds that capability to the administrator role on activation. -
Can administrators impersonate other administrators?
-
On single-site installs, administrator-to-administrator switching is blocked by default. Developers can opt in with the
dd_login_as_user_allow_admin_targetfilter. -
How long does a switch session last?
-
The default timeout is 60 minutes. It can be adjusted with the
DD_LOGIN_AS_USER_TIMEOUTconstant or thedd_login_as_user_timeoutfilter.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Dalmatian Dream Login As User” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Dalmatian Dream Login As User” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.0.8
- Removed unused storage of the original administrator WordPress session token.
- Reduced temporary switch-session state to the minimum data required for secure account switching.
2.0.7
- Prepared plugin metadata and documentation for WordPress.org Plugin Directory review.
- Updated WordPress compatibility metadata.
- Clarified privacy and local switch-session storage behavior.
2.0.6
- Added the plugin languages folder.
- Documented the intentional WordPress core login hook call for compatibility.
2.0.5
- Restored the impersonated account early from the secure switch token when the WordPress auth cookie is not accepted.
- Fired the standard WordPress login action after a successful switch.
2.0.4
- Changed successful switch landing to the admin dashboard instead of the user profile screen.
- Prevented cached profile redirects from blocking impersonation when profile access is hidden.
- Set a persistent authentication cookie for the impersonated account.
2.0.3
- Fixed Plugin Check internationalization and redirect sanitization findings.
- Removed discouraged manual translation loading call.
2.0.2
- Changed successful switch redirect to the impersonated user’s profile panel.
2.0.1
- Fixed blank page after switching to another user.
- Fixed blank page after returning to the administrator account.
- Improved safe local redirect handling after account switches.
2.0.0
- Reworked user impersonation session security.
- Added unique switch-session tokens.
- Added secure return-to-administrator workflow.
- Added dedicated switch capability.
- Added multisite and administrator-target protections.
- Improved nonce, input sanitization and redirect handling.
- Added internationalization support.
- Removed production debug output.
- Added lightweight audit hooks.
- Improved WordPress.org / Plugin Check compatibility.