Everything people ask before buying.

A WordPress plugin that turns your site into a credential authority. You issue certificates, licences or compliance records from the admin, and anyone can confirm they're genuine through a public lookup page on your own domain.

WordPress 6.4 or newer, PHP 7.4+, and a site you can install plugins on. You also need PHP's GD image extension, which draws the certificates and QR codes — effectively every host has it, and Attestra tells you plainly if yours does not. If you plan to upload your own PDFs, the Imagick extension lets Attestra read any of them; without it, PDFs whose pages are each a single full-page image still work, which covers scans and most print output. There's no external service to sign up for and nothing to configure at the server level.

Yes. The lookup form is a shortcode, so it drops into Elementor, WPBakery, Divi, Beaver Builder or the block editor like any other element, and you build the page around it however you build the rest of your site. Attestra also reads your accent colour from your page builder or theme and matches it automatically — there is no colour to configure unless you want the form to look deliberately different.

Yes — seven days on one website, with every feature unlocked and no card required. It is the same plugin the paid licences install, not a cut-down edition, so anything you build during the trial is real work rather than a demo. Start a free trial.

Most people publish their first real credential inside an afternoon. Installing and activating takes about two minutes; the time goes into deciding what fields your credential should carry. See the four steps.

That's the whole point. They scan the QR code, type the credential ID, or upload the certificate itself — and get the status straight away, with no sign-up anywhere, for them or for you.

Four things in order: the record exists, the issuer signature matches, it hasn't been revoked, and today falls inside the validity window. The result is a clear verdict, not a raw data dump.

Yes, with a reason you write. The record stays verifiable but reports as revoked, so anyone checking gets the truth rather than a dead link.

It flips to Expired automatically on the date you set. You choose per category whether expired records stay publicly visible as proof of history or drop out of search.

Yes, and the change is logged with a timestamp. Amendment history is part of the record, which is what makes it hold up when an auditor asks.

No. You can generate certificates from a template, or bring a document you already have — a signed licence, an awarding body’s own artwork, a scan of something printed years ago. Upload a PDF, JPG, PNG or WebP, drag the QR code onto a clear part of the page, and issue. The file is kept exactly as it is and the code goes on a copy.

Every page is kept and every page is downloaded. You choose which page carries the QR code, or have it repeat in the same spot on all of them — worth doing for a report whose pages may be separated, since a page handed over on its own can still be checked. On the verification page the reader moves through the document a page at a time.

Yes. The lookup page has a second tab where a PDF, JPG or PNG can be handed over instead of typing an ID — including a photograph of a printed certificate, as long as the QR code is in shot. Attestra reads the file only to work out which credential it refers to, then checks that credential against your register exactly as a typed ID would be. The file is not kept.

No. The uploaded file only decides which record to look up; your register decides the answer. A forged or edited certificate resolves to whatever the register actually says — not found, revoked, expired — and there is nothing that can be put in a file to change that.

Yes, as a PDF, a JPEG or a PNG, straight from a verified result. You can switch downloads off entirely, or allow them for some credential categories and not others.

Partly, and it is worth being precise about which part. Turn protection on and the page shows a reduced-resolution copy while the print-resolution original stops being reachable by any address — that part is real, and it is what stops a certificate being reproduced convincingly. Right-click, dragging and printing are blocked too, but those are a deterrent rather than protection: no website can prevent a screenshot, and we would rather say so than let you believe otherwise.

Yes. Create a batch — a class, an intake, a round of renewals — set the category, award and dates once, then paste in the names, one per line. Email addresses can follow a name after a comma or in angle brackets, so a column pasted straight out of a register is read correctly.

Yes, as a single archive, with a spreadsheet inside listing which file belongs to whom. The same works for any set of credentials you select on the Credentials screen, whether or not they are in a batch. You can also email a whole batch to its recipients in one go.

Yes, two ways. Choose one batch for the whole file on the mapping step, or add a batch column so a single spreadsheet can be split across several cohorts. Names in the file that don't exist yet become new batches; names that already exist are reused, so importing a corrected file twice doesn't leave you with duplicates.

Yes. Select them on the Credentials screen and add them to a batch, move them to a different one, or take them out. Moving a credential only changes how it is grouped — its ID, certificate and validity are untouched, and it stays verifiable throughout. Every move is recorded in that credential's amendment history.

Yes, and it writes nothing at all. It reports what would be created, updated or skipped, and which batches would be made, without creating any of them.

In your own WordPress database, on your own hosting. There's no external service holding your records, and nothing breaks if you change hosts.

The only outbound call is a licence check against our server, which sends your site domain and licence key — never credential data. See the privacy policy.

Your records stay in the database untouched. Public verification pages stop resolving while it's inactive, and come straight back when you reactivate.

Yes. Export any category to CSV at any time, and the PDFs are yours to keep. We'd rather you stayed because it works, not because leaving is painful.

Yes. Attestra stays installed and every published credential stays verifiable. What stops is access to new updates and support, so renewing keeps you on the latest version.

A key is registered to one site and only works on that site. If you are moving to a new domain, rebuilding, or shifting to a different server, email us with the old address and the new one and we will move the key across for you.

No. Common staging patterns — staging., dev., .local and similar — are recognised and don't consume a slot.

Prices are in USD. You can pay by JazzCash, Easypaisa, SadaPay, NayaPay, Payoneer or bank transfer. If you need an invoice or a purchase order, say so and we will raise one — the key follows once payment clears. Want to pay another way? Ask us and we will sort it out.

Get in touch and tell us about your organisation — we are happy to talk it through and find something that works, particularly if you are buying for several departments. Contact us.

Fourteen days, any reason, no questions. Read the refund policy for how to ask.

Email support is included on every plan, with priority queues on Studio and above. Most questions are answered within one working day. Contact support.

Every few months for features, and immediately for anything security-related. The changelog lists every release since January 2022.

On Enterprise, yes — custom development is part of the arrangement. Tell us what you need.