Everything, in one page.

Installation

Attestra installs like any other WordPress plugin. You'll need WordPress 6.4 or newer and PHP 7.4+. If you plan to upload your own PDFs, the Imagick PHP extension lets Attestra read any of them; without it, PDFs whose pages are each a single full-page image still work, which covers scans and most print output. JPG, PNG and WebP always work.

1. Download the zip from your order confirmation email, or from the link on the checkout confirmation page.
2. In your admin, go to Plugins → Add New → Upload Plugin and choose the zip.
3. Click Install Now, then Activate.
4. Open Attestra → Licence, paste your key and click Activate this site.

That's it. Attestra adds a single top-level menu item and creates its own database tables. It does not modify your theme, your posts, or any existing content.

Trial keys work the same way. A key from the trial page unlocks every feature on one domain for seven days. When it lapses, your records stay in the database untouched.

Credential categories

A category is the shape of a credential — a diploma, a safety ticket, an audit certificate. Everything else hangs off it, so this is the first thing to set up.

Go to Attestra → Categories → Add new and set:

• Name and slug. The slug appears in public URLs, so keep it short and readable.
• Fields. Which pieces of data this credential carries. See custom fields below.
• Template. Portrait or landscape, plus the seal, border and signature block.
• Default validity. Leave blank for credentials that never expire, or set a period like 36 months.
• Visibility. Whether expired records stay publicly listed as history or drop out of search.

Most organisations need two or three categories. Resist the urge to make one per cohort — use tags for that instead.

Custom fields

Fields are defined per category and reused across every record in it. Nine types are available:

Each field has a public toggle. Turn it off and the value is stored and searchable in admin but never appears on the verification page — useful for internal student numbers.

Issuing records

One at a time

Attestra → Records → Add new. Pick a category, fill the fields, and publish. The credential ID, QR code, public page and PDF are all generated on publish.

In bulk, from CSV

Attestra → Import. Upload a CSV whose first row is a header, map each column onto a field, and preview before committing.

full_name,award,grade,issued_on,expires_on
Sarah Mitchell,Advanced Data Analytics,Distinction,2026-03-12,2029-03-12
James Okonkwo,Advanced Data Analytics,Merit,2026-03-12,2029-03-12

• Dates should be YYYY-MM-DD. Other common formats are detected, but this one never surprises you.
• Save your column mapping as a profile and the next import is one click.
• Rows that fail validation are reported and skipped — the rest still import.
• Duplicate credential IDs are detected before anything is written.

Uploading your own document

Not every credential needs generating. If the document already exists — a signed licence, an awarding body’s own artwork, a scan of something printed years ago — issue that file as it stands and let Attestra add the QR code to a copy. The original is never altered.

On Records → Add new, choose Upload my own document and place a QR code on it, or use the Upload a document link on the Credentials list, which starts the form on that setting.

1. Choose the file. PDF, JPG, PNG or WebP, up to 30 MB. Drop it on the panel or browse for it.
2. Place the code. The document appears as soon as it uploads. Drag the marker onto a clear part of the page and set its size — a plain background scans most reliably.
3. Issue. The copy that goes out carries the code exactly where you put it.

Placement happens before anything is saved, on purpose: the first copy rendered and emailed is the one you laid out, rather than one you correct afterwards once the holder already has it.

Documents that run to several pages

• Every page is kept and every page is downloaded. Nothing is flattened to a cover sheet.
• Choose which page carries the code with the Page selector above the preview.
• Tick Put the code on every page, in this same spot for a report whose pages get separated — a sheet handed over on its own can still be checked.
• On the verification page the reader turns through the document a page at a time.

The size is a percentage of the document width. A code that would print smaller than about 4 mm is enlarged a little so it stays scannable.

The verification portal

Create a page — most people call it Verify — and drop in the shortcode:

[attestra_verify]

That renders the lookup field, handles the query, and shows the verdict. Optional attributes:

Other shortcodes:

• [attestra_record id="ATT-2026-4417"] — embed one credential anywhere.
• [attestra_list category="diplomas" limit="20"] — a public register.
• [attestra_count category="diplomas"] — a live issued count.

Verifying from the file itself

Someone holding the certificate but not the ID can hand over the file instead. The lookup form accepts a PDF, JPG or PNG — including a photograph of a printed one — and the built-in reader finds the QR code on it, then checks that credential against the register exactly as a typed ID would be.

The file only decides which record to look up. The register decides the answer, so an edited or forged certificate resolves to whatever the register actually says about it.

Batches, backups and reports

Batches

A batch groups records that belong together — a class, an intake, a round of renewals. Create one under Attestra → Batches, assign records to it from the Credentials list, or name a batch in a column during a CSV import so one spreadsheet covers several cohorts.

Moving a record between batches changes only how it is grouped. Its ID, its certificate and its validity are untouched, and it stays verifiable throughout.

Backups

Attestra → Tools writes a single archive holding your categories, templates, custom fields, settings and records, and restores one on another install. Your licence key is deliberately left out: a licence is bound to one domain, so carrying it into a restore elsewhere would fail the next time it checked in. The destination site activates with its own.

Reports

Attestra → Reports covers six things: the register itself, every public lookup, credentials due to expire inside a window you choose, withdrawn credentials and the reason recorded at the time, per-category counts, and which certificates were emailed and which failed. Filter by category, status and date range, run one now, or save it to arrive weekly or monthly.

Verification history

Every public lookup is logged with its result and the time. Attestra → Verifications shows the counts and a filterable log; logging can be switched off, and old entries trimmed, under Tools.

Whitelabel and branding

Under Attestra → Settings → Branding you can replace every visible trace of the plugin:

• Rename the admin menu item to anything you like.
• Swap the admin logo for your own.
• Set the primary colour used across the interface.
• Remove developer credits from the footer of public pages.
• Hide the plugin entirely from administrators other than yourself.

Handing a site to a client? The client needs a licence of their own to keep receiving updates. Their records, categories and templates all stay exactly where they are either way — a lapsed licence stops updates and support, not the plugin.

Troubleshooting

The licence won't activate

Check the domain matches exactly — yoursite.com and www.yoursite.com count as the same site, but yoursite.co.uk does not. If your host blocks outbound connections, allow attestrasolutions.online.

PDFs look wrong or clip

PDFs render in the browser. If a signature block clips, raise the safety margin under Settings → PDF. On phones that can't render locally, Attestra falls back to a server-generated file automatically.

Verification returns nothing

Confirm the record is published rather than draft, and that the category allows public lookup. If you restricted the shortcode with category=, an ID from a different category won't resolve.

Expiry dates seem a day out

Set your timezone properly under Settings → General in WordPress. Attestra follows the site timezone, not the server's.

Still stuck? Contact support with your credential ID and we'll take a look.