Title: Doppelganger
Author: Christian Doebler
Published: <strong>2026-يىلى 28-ئىيۇن</strong>
Last modified: 2026-يىلى 28-ئىيۇن

---

قىستۇرما ئىزدە

![](https://ps.w.org/doppelganger/assets/banner-772x250.png?rev=3588858)

![](https://s.w.org/plugins/geopattern-icon/doppelganger_ffffff.svg)

# Doppelganger

 يازغۇچى [Christian Doebler](https://profiles.wordpress.org/grissi/)

[چۈشۈر](https://downloads.wordpress.org/plugin/doppelganger.1.0.0.zip)

 * [تەپسىلاتلار](https://ug.wordpress.org/plugins/doppelganger/#description)
 * [باھالاشلار](https://ug.wordpress.org/plugins/doppelganger/#reviews)
 * [ئىجادىيەت](https://ug.wordpress.org/plugins/doppelganger/#developers)

 [قوللاش](https://wordpress.org/support/plugin/doppelganger/)

## چۈشەندۈرۈش

Doppelganger allows admins to instantly switch sessions to any user for debugging
and testing role capabilities securely via cookies.

### Features

 * **Seamless Integration**: Works out-of-the-box with WordPress authentication 
   system.
 * **Configurable**: Customize permissions, UI position, and behavior through WordPress
   filters.
 * **Environment Control**: Restrict user switching to specific environments (e.
   g., `local`, `development`) to prevent accidents in production.
 * **Cookie-based Impersonation**: Securely impersonates users by maintaining the
   original user’s ID in a signed cookie.
 * **Persistent Authorization**: Switcher remains visible when impersonating less-
   privileged users, allowing easy switching back.

### Requirements

 * PHP 8.2 or higher
 * WordPress 6.8 or higher
 * Composer

### Usage

 1. **Log in as an Administrator.**
     By default, only users with the `edit_users` capability(
    typically Administrators) can see and use the switcher.
 2. **Switch User**
 3.  * Look for the «Switch User» toggle in the bottom-right corner of the screen.
     * Click it to open the user list.
     * Click on any user to switch to their account.
 4. **Impersonation Mode**
 5.  * While impersonating, a «Stop Impersonating» banner/button will be visible.
     * You are effectively logged in as that user, with their permissions.
 6. **Stop Impersonating**
 7.  * Click «Stop Impersonating» to return to your original administrative account.

### Configuration

The plugin is designed to work out-of-the-box, with three layers of configuration(
in order of precedence):

 1. **Default Behavior** – Works immediately after installation
 2. **wp-config.php Constants** – Simple toggles for non-technical users
 3. **WordPress Filters** – Advanced customization for developers

### Default Behavior

Out of the box, the plugin:
 – **Enabled**: Yes (active in all environments) – **
Environments**: All environments (`*` wildcard) – **Authorization**: Users with `
edit_users` capability (typically Administrators)

### Simple Configuration (wp-config.php Constants)

For basic on/off toggles and environment control, add constants to your `wp-config.
php` file:

    ```
    // Disable the plugin completely
    define('DOPPELGANGER_ENABLED', false);

    // Restrict to development environments (comma-separated)
    define('DOPPELGANGER_ALLOWED_ENVIRONMENTS', 'local,development');

    // Or allow specific environments including staging
    define('DOPPELGANGER_ALLOWED_ENVIRONMENTS', 'local,development,staging');

    // Allow all environments (default)
    define('DOPPELGANGER_ALLOWED_ENVIRONMENTS', '*');
    ```

**Important:** Constants take precedence over filters. If a constant is defined,
filters for that setting will be ignored with a warning in debug mode and the WordPress
admin dashboard.

### Development Mode (Only for development; EXTREMELY DANGEROUS)

    ```
    // Enable dev mode - BYPASSES ALL SECURITY CHECKS
    define('DOPPELGANGER_DEV_MODE', true);
    ```

** CRITICAL SECURITY WARNING:**

When `DOPPELGANGER_DEV_MODE` is enabled:
 – **ALL users can switch to ANY account**(
including administrators) – **Even guests (not logged in) can use the switcher**–
Bypasses environment restrictions – Bypasses authorization checks – Bypasses ALL
security measures

**This constant is ONLY for:**
 – Local development and debugging – Testing user
permission flows – Reproducing user-reported issues

**NEVER EVER:**
 – Use this in production – Use this in staging (unless absolutely
necessary and temporarily) – Commit this to version control – Leave it enabled after
debugging

A persistent **red warning banner** will appear in the WordPress admin dashboard
when dev mode is active. If you see this warning in production, **disable dev mode
immediately** by removing the constant from `wp-config.php`.

**Note:** The main `DOPPELGANGER_ENABLED=false` constant still works as an emergency
kill switch even when dev mode is active.

### Advanced Configuration (WordPress Filters)

For complex logic and dynamic behavior, use WordPress filters in your theme’s `functions.
php` or a custom plugin:

### Environment Control

    ```
    add_filter('doppelganger_allowed_environments', function(array $environments): array {
        // Only allow in local and development
        return ['local', 'development'];
    });

    // Or allow multiple environments
    add_filter('doppelganger_allowed_environments', function(array $environments): array {
        return ['local', 'development', 'staging'];
    });
    ```

**Note:** This filter is ignored if `DOPPELGANGER_ALLOWED_ENVIRONMENTS` constant
is defined.

### Permissions (Authorization)

By default, `edit_users` capability is required. You can change this logic:

    ```
    add_filter('doppelganger_can_switch', function(bool $canSwitch, int $currentUserId): bool {
        // Example: Allow users with manage_options capability instead
        return user_can($currentUserId, 'manage_options');

        // Or allow specific user IDs
        // return in_array($currentUserId, [1, 5, 10], true);

        // Or allow all users and even guests (helpful for debugging)
        // return true;
    }, 10, 2);
    ```

### How Authorization Works During Impersonation

**Important:** When you’re impersonating another user, authorization checks are 
based on the **original user** (the one who started impersonation), not the currently
impersonated user.

This means:
 – If an admin switches to a regular user, the switcher widget remains
visible – The admin can continue switching to other users – Authorization is always
checked against the original admin, not the impersonated user

This prevents the common issue where the switcher disappears after switching to 
an unauthorized user.

**Example Scenario:**
 1. Admin (authorized) logs in  Widget appears 2. Admin switches
to Regular User (unauthorized)  Widget **still appears** 3. Admin can switch back
or to other users 4. Regular User logs in directly  Widget does **not** appear

### UI Configuration

Customize the renderer configuration:

    ```
    add_filter('doppelganger_config', function(array $config): array {
        // You can modify the default config or return a completely new one
        $config['position'] = 'bottom-left'; // 'bottom-right', 'bottom-left', 'top-right', 'top-left'
        $config['param_name'] = '_my_custom_switch_param'; // Custom URL parameter name

        return $config;
    });
    ```

Available configuration options:
 – `position`: Widget position on screen (`bottom-
right`, `bottom-left`, `top-right`, `top-left`) – `param_name`: URL parameter name
for switching (default: `doppelganger_switch`) – `current_user_id`: Current user
ID (automatically set, usually don’t override)

### Database Options (Alternative to Constants)

The plugin also checks a database option for the enabled state. This is useful if
you need to toggle the plugin programmatically:

    ```
    // Disable the plugin via database
    update_option('doppelganger_enabled', false);

    // Re-enable it
    update_option('doppelganger_enabled', true);
    ```

**Note:** The `DOPPELGANGER_ENABLED` constant takes precedence over this database
option.

### Security

 * **Return Ticket**: When switching, a secure cookie is set containing the original
   admin’s ID. This cookie is signed using `wp_hash()` with a nonce salt to prevent
   tampering.
 * **Validation**: Authentication cookies are re-issued securely using WordPress
   core functions.

## باھالاشلار

بۇ قىستۇرمىغا تېخى باھا يېزىلمىدى.

## تۆھپىكار ۋە ئىجادكار

«Doppelganger» كودى ئوچۇق يۇمشاق دېتال. تۆۋەندىكى كىشىلەر بۇ قىستۇرمىغا تۆھپە قوشقان.

تۆھپىكار

 *   [ Christian Doebler ](https://profiles.wordpress.org/grissi/)

[«Doppelganger» نى تىلىڭىزغا تەرجىمە قىلىڭ](https://translate.wordpress.org/projects/wp-plugins/doppelganger)

### ئىجادىيەتكە قىزىقامسىز؟

[كودقا كۆز يۈگۈرتۈپ](https://plugins.trac.wordpress.org/browser/doppelganger/)، 
[SVN خەزىنە](https://plugins.svn.wordpress.org/doppelganger/) تەكشۈرۈپ ياكى [RSS](https://plugins.trac.wordpress.org/log/doppelganger/?limit=100&mode=stop_on_copy&format=rss)
ئارقىلىق [ئىجادىيەت خاتىرىسى](https://plugins.trac.wordpress.org/log/doppelganger/)
گە مۇشتەرى بولغىلى بولىدۇ.

## Meta

 *  Version **1.0.0**
 *  ئاخىرقى يېڭىلانغان ۋاقىت **1 ئاي بۇرۇن**
 *  ئاكتىپ ئورنىتىش سانى **10 دىن ئاز**
 *  WordPress نەشرى ** 6.8 ياكى يۇقىرى **
 *  **6.9.6** دا سىنالغان
 *  PHP نەشرى ** 8.2 ياكى يۇقىرى **
 *  تىل
 * [English (US)](https://wordpress.org/plugins/doppelganger/)
 *  [ئالىي كۆرۈنۈش](https://ug.wordpress.org/plugins/doppelganger/advanced/)

## دەرىجە

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/doppelganger/reviews/#new-post)

[بارلىق ئىنكاسنى كۆرسەت](https://wordpress.org/support/plugin/doppelganger/reviews/)

## تۆھپىكار

 *   [ Christian Doebler ](https://profiles.wordpress.org/grissi/)

## قوللاش

چۈشەندۈرۈشىڭىز بارمۇ؟ ياردەم لازىممۇ؟

 [قوللاش مۇنبىرىنى كۆرسەت](https://wordpress.org/support/plugin/doppelganger/)