Set up Login As User safely
Let trusted staff see the forum exactly as a member does, with password confirmation, time limits and a full audit log.
Updated 4 min read By the D.C Style team
On this page
Login As User lets trusted staff see the forum exactly as a member sees it, which is the fastest way to answer "why can't I see this?" questions. Nobody can use it until you grant the permission, and every session is logged. Setting it up means choosing who can use it, who is protected from it, and how long a session may last. It needs XenForo 2.3 and PHP 8.0 or newer.
Choose who can log in as members
Go to Groups & permissions > User group permissions and open the group your staff are in, such as Moderating. In the D.C Style - Login as user section, set Log in as another member to Yes.
Give this to as few people as possible. Anyone with it can see private conversations and settings as the member would. XenForo permissions explained covers how groups combine.
Protect accounts that must never be used
Administrators can never be logged in as, whatever the permissions say. For anyone else you want to protect, such as moderators or VIPs, set Cannot be logged in as to Yes for their group.
One exception is built into XenForo itself: banned, unconfirmed and disabled accounts are checked with guest permissions, so the protection does not follow them. Staff can still log in as a restricted account, and the add-on tells them they will see what that restricted member sees.
Set the session rules
The options are in Setup > Options > D.C Style - Login as user.
| Option | Default | What it does |
|---|---|---|
| Require password confirmation | On | Staff re-enter their own password before taking over an account. Each takeover is confirmed separately, so a stolen staff session is not enough on its own. |
| Maximum session length | 30 minutes | Staff are returned to their own account after this long. 0 means no limit, but XenForo's own sessions end after 4 hours anyway. |
| Log retention | 365 days | How long finished sessions stay in the log. 0 keeps them forever. |
Hide the visit from the member
Hide the visit from the impersonated account decides what the member will not notice afterwards. Everything is ticked by default:
- Currently online list
- Last activity time
- Marking threads and forums as read
- Marking alerts as read
- Marking direct messages as read
- IP address logging
Untick an item to let it behave normally. "Currently online list" and "Last activity time" are the same record in XenForo, so hiding one also freezes the other.
Note: If your forum uses Cloudflare or a DigitalPoint add-on, run Login As User 1.1.0 Patch Level 3 or newer. Earlier versions could still show the member as online on those setups.
Using it day to day
Staff with the permission find Log in as... in several places, including the member's profile and a post's action bar (Log in as author), and in the Admin CP when editing a user. While logged in as someone, the staff bar shows who you are browsing as, with a button to return to your own account. Logging out also returns you. You cannot log in as a second member from inside a session: return to your own account first.
Audit log and live sessions
- Logs > Users > Login as user log lists every session: who, as whom, when, and how it ended.
- Users > Active login-as sessions shows sessions running right now. Administrators with the Login as user: end active sessions admin permission can end one immediately.
Two cron entries keep things tidy. Login as user: close abandoned sessions runs four times an hour, and Login as user: prune log runs daily. Both need XenForo's scheduled tasks running: keep scheduled tasks running.
If the menu items do not appear for a staff member, check their permission first, then the usual reasons an add-on shows nothing. More detail is on the Login As User page.
Still stuck? Open a support ticket with your XenForo version, the add-on version and which entry point is missing or failing.