Verakta

Verakta gives any organization — training providers, universities, event organizers, professional associations — a way to:

1. Bulk-upload certificate data via CSV.
2. Offer a public verification page where anyone can enter a certificate number and get an instant, trustworthy confirmation.

Nothing is hardcoded: no institution name, no number format, no interface text. Everything is configured from the settings page, so a fresh install is ready to use without touching any code.

Key features

• Bulk import from CSV or Excel (.xlsx) with flexible column mapping, a preview step before anything is committed, and configurable duplicate handling (skip, overwrite, or cancel the whole import). Excel date cells are converted automatically.
• Public verification without a page reload (AJAX), with a working non-JavaScript fallback for accessibility and reliability.
• Configurable name privacy: show the full name, a masked name (e.g. Bu*i Sa****o), or require both the number and the name to match.
• Configurable certificate number format: free-form (no validation), a simple segment-based pattern builder, or a custom regex for unusual formats.
• Native Elementor widget with full styling controls (typography, colors, border radius, spacing) — plus a Gutenberg block and a [verakta] shortcode for everywhere else.
• Rate limiting per IP and a honeypot field to keep the public endpoint from being abused.
• Audit log recording every import, addition, and edit.
• Translation-ready, shipping with Indonesian and English out of the box.

Security

Security was treated as a first-class requirement throughout development, not an afterthought:

• Every database query goes through $wpdb->prepare() — no SQL string built by concatenating user input.
• All input is sanitized and all output is escaped.
• CSV formula-injection protection on import (cells starting with =, +, -, or @ are neutralized).
• Every admin action is protected by a WordPress nonce and a capability check.
• A dedicated manage_certificates capability, so an operator can be granted access without making them a full Administrator.
• Rate limiting and a honeypot field on the public verification endpoint, with optional trusted-proxy support for sites behind a CDN.
• The public AJAX endpoint only ever performs read operations.
• A custom regex number-format pattern is linted for ReDoS risk (nested quantifiers) both when it’s saved and, as a hard backstop, again at match time via PCRE2 execution limits.
• No connection to any external/third-party service — all verification logic, rate limiting, and data storage happen entirely on your own WordPress site.