Verakta

Verakta gives any organization — training providers, universities,
event organizers, professional associations — a way to:

1. Bulk-upload certificate data via CSV.
2. Offer a public verification page where anyone can enter a certificate
   number and get an instant, trustworthy confirmation.

Nothing is hardcoded: no institution name, no number format, no interface
text. Everything is configured from the settings page, so a fresh install
is ready to use without touching any code.

Key features

• Bulk import from CSV or Excel (.xlsx) with flexible column mapping,
  a preview step before anything is committed, and configurable duplicate
  handling (skip, overwrite, or cancel the whole import). Excel date
  cells are converted automatically.
• Public verification without a page reload (AJAX), with a working
  non-JavaScript fallback for accessibility and reliability.
• Configurable name privacy: show the full name, a masked name (e.g.
  Bu*i Sa****o), or require both the number and the name to match.
• Configurable certificate number format: free-form (no validation),
  a simple segment-based pattern builder, or a custom regex for unusual
  formats.
• Native Elementor widget with full styling controls (typography,
  colors, border radius, spacing) — plus a Gutenberg block and a
  [verakta] shortcode for everywhere else.
• Rate limiting per IP and a honeypot field to keep the public
  endpoint from being abused.
• Audit log recording every import, addition, and edit.
• Translation-ready, shipping with Indonesian and English out of the
  box.

Security

Security was treated as a first-class requirement throughout development,
not an afterthought:

• Every database query goes through $wpdb->prepare() — no SQL string
  built by concatenating user input.
• All input is sanitized and all output is escaped.
• CSV formula-injection protection on import (cells starting with =,
  +, -, or @ are neutralized).
• Every admin action is protected by a WordPress nonce and a capability
  check.
• A dedicated manage_certificates capability, so an operator can be
  granted access without making them a full Administrator.
• Rate limiting and a honeypot field on the public verification endpoint,
  with optional trusted-proxy support for sites behind a CDN.
• The public AJAX endpoint only ever performs read operations.
• A custom regex number-format pattern is linted for ReDoS risk (nested
  quantifiers) both when it’s saved and, as a hard backstop, again at
  match time via PCRE2 execution limits.
• No connection to any external/third-party service — all verification
  logic, rate limiting, and data storage happen entirely on your own
  WordPress site.