User Switching exposes the switch_to_user, switch_back_user, and switch_off_user action hooks, which fire each time an admin steps into another account or returns to their own. The plugin itself does not write a persistent log table by default, so an audit trail requires either pairing it with an event logger such as Simple History or wiring a small custom plugin to record each event into a dedicated table.

Once those events are captured, SleekView reads the audit table directly. Each row carries the switching admin, the target user, the event type (switched in, switched off, switched back), the source IP, and the timestamp. Filter to a single admin to review their last week of impersonation. Filter by target user to confirm no unauthorized account was accessed during a sensitive period. Sort by timestamp to step through a session.

For compliance teams, that captured trail is the difference between trusting a verbal account and producing a queryable record. SleekView keeps the data read-only by default, gates the view with WordPress capabilities so only the right roles can see it, and exports filtered slices to CSV when an auditor asks for a window covering a specific incident.

Switching into a customer account is a routine support action that also looks identical, in the database, to a compromise. The same plugin that lets a support agent legitimately impersonate a buyer to debug their cart also lets an attacker who has captured an admin session impersonate any customer. The difference between routine ops and incident is the audit trail, and User Switching deliberately leaves the recording decision to the site owner so each team can choose its own logger and retention policy.

Once that decision is made and switch events are flowing into a table, the next problem is making them readable. Compliance leads do not want to write SQL, support managers want a per-team view, and incident responders need a date window scoped to one IP within ninety seconds of starting the response. A queryable grid with capability gating and CSV export turns a bare audit table into the working surface those roles actually need, without altering the capture pipeline or weakening the trustworthiness of the records themselves.