外掛標籤
開發者團隊
原文外掛簡介
Verakta gives any organization — training providers, universities,
event organizers, professional associations — a way to:
Bulk-upload certificate data via CSV.
Offer a public verification page where anyone can enter a certificate
number and get an instant, trustworthy confirmation.
Nothing is hardcoded: no institution name, no number format, no interface
text. Everything is configured from the settings page, so a fresh install
is ready to use without touching any code.
Key features
Bulk import from CSV or Excel (.xlsx) with flexible column mapping,
a preview step before anything is committed, and configurable duplicate
handling (skip, overwrite, or cancel the whole import). Excel date
cells are converted automatically.
Public verification without a page reload (AJAX), with a working
non-JavaScript fallback for accessibility and reliability.
Configurable name privacy: show the full name, a masked name (e.g.
Bu*i Sa****o), or require both the number and the name to match.
Configurable certificate number format: free-form (no validation),
a simple segment-based pattern builder, or a custom regex for unusual
formats.
Native Elementor widget with full styling controls (typography,
colors, border radius, spacing) — plus a Gutenberg block and a
[verakta] shortcode for everywhere else.
Rate limiting per IP and a honeypot field to keep the public
endpoint from being abused.
Audit log recording every import, addition, and edit.
Translation-ready, shipping with Indonesian and English out of the
box.
Security
Security was treated as a first-class requirement throughout development,
not an afterthought:
Every database query goes through $wpdb->prepare() — no SQL string
built by concatenating user input.
All input is sanitized and all output is escaped.
CSV formula-injection protection on import (cells starting with =,
+, -, or @ are neutralized).
Every admin action is protected by a WordPress nonce and a capability
check.
A dedicated manage_certificates capability, so an operator can be
granted access without making them a full Administrator.
Rate limiting and a honeypot field on the public verification endpoint,
with optional trusted-proxy support for sites behind a CDN.
The public AJAX endpoint only ever performs read operations.
A custom regex number-format pattern is linted for ReDoS risk (nested
quantifiers) both when it’s saved and, as a hard backstop, again at
match time via PCRE2 execution limits.
No connection to any external/third-party service — all verification
logic, rate limiting, and data storage happen entirely on your own
WordPress site.
