On this page
- Certificate data security starts with backups
- What should be public on the verification page?
- Who should be able to manage credentials?
- A certificate data security checklist
- Certificate data security and privacy laws
- Roles and access for certificate data
- Incident checklist for certificate data security
- Frequently asked questions
Short answer: Good certificate data security on WordPress means storing backups off the server, showing only the fields verifiers need, hashing IP addresses in logs, limiting who can manage credentials, keeping WordPress and plugins updated, and sending email through a proper SMTP service.
A credential register is personal data: names, email addresses, qualifications and dates. Running it on your own WordPress site keeps you in control; however, it also makes you responsible. This checklist covers certificate data security without adding friction.
Key takeaways
- Backups belong on your computer or private storage, not in a public folder.
- Publish the minimum: hide internal fields from the verification page.
- Give staff only the access they need.
- Update promptly and use SMTP for email.
Certificate data security starts with backups
Because backups contain every holder’s details, they should never sit in a web-accessible folder. CertiQR builds the backup in the server’s temporary directory, downloads it straight to you and deletes it immediately. Then store it encrypted or in a private drive.
What should be public on the verification page?
- Usually: name, award, issue and expiry dates, status.
- Rarely: email addresses, phone numbers or internal reference numbers – keep these hidden.
- Optional: require the holder’s surname before showing anything.
Who should be able to manage credentials?
Limit credential management to the roles that need it, and use strong passwords with two-factor authentication for administrators. With a licence you can also hide the plugin from other administrators entirely.
A certificate data security checklist
- Keep WordPress, your theme and plugins updated.
- Also use HTTPS everywhere.
- Send email through an SMTP plugin.
- Meanwhile, review the verification log for unusual activity – CertiQR stores IP addresses hashed.
- Finally, download a fresh backup before major changes.
In short, certificate data security comes down to a few good habits. Related: why self-hosted verification beats SaaS.
Certificate data security and privacy laws
Credential records include personal data, so privacy laws such as the GDPR may apply to you. Therefore, publish only what verifiers need, explain the processing in your privacy policy, and respond to data requests promptly. In addition, keep records only as long as your policy and regulator require.
Roles and access for certificate data
| Person | Suggested access |
|---|---|
| Owner or administrator | Full access, including settings and backups |
| Training coordinator | Issue and edit credentials |
| Auditor | Reports and the public verification page |
| Website editor | No access to credential records |
Incident checklist for certificate data security
- First, change administrator passwords and enable two-factor login.
- Next, update WordPress, themes and plugins.
- Then check the verification log and user list for anything unusual.
- After that, restore from a clean backup if needed.
- Finally, follow your legal duties for reporting a data breach.
In addition, the WordPress hardening guide is a useful, independent reference if you want to read further.
Frequently asked questions
QIs it GDPR-friendly to publish certificates online?
It can be, if you publish only what is necessary, explain it in your privacy policy and honour data requests. Besides, keeping the data on your own site makes this easier to control.
QWhere does CertiQR keep certificate data?
In a dedicated folder in your WordPress uploads. With a licence, copy protection serves a reduced copy on the verification page and blocks direct access to the full-size file.
QCan a restored backup contain malicious files?
CertiQR only restores certificate images and PDFs from a backup, so a tampered archive cannot place executable code on your site.
Ready to try it?
Run a credential register that is private by design on your own WordPress site. Try CertiQR free for 7 days.
Should certificate PDFs be public?
Only if you want holders and verifiers to download them. Otherwise, turn on copy protection so the page shows a reduced copy.
How often should I back up credential data?
At least weekly, and always before major changes. Also, store backups somewhere other than your web server.
We build CertiQR, the WordPress plugin for issuing certificates and verifying them with a QR code. We write about credentials, verification and running a certificate programme.
