WordPress Plugin

Proof that a certificate is real, published on your own site.

Certloom is an advanced WordPress certification plugin. It gives certification bodies, training providers, associations and auditors a certificate registry and a public verification page on the site they already run, with no separate service in the middle.

Download Ask a question

The problem

A certificate is only worth what someone else can confirm. When an employer wants to check one, the usual answer is an email to the training provider and a wait of several days, or a PDF that anyone could have edited.

The alternative has been signing up to a verification service, which means your records live on someone else's platform, on their pricing, with their branding around your credentials.

What we built

A registry that lives in your own WordPress database and a public page where anyone can type a certificate number and see its current status. Nothing leaves your site and there is no external service to depend on.

The lookup is deliberately strict. It matches the complete number only, never a partial one, so nobody can probe the registry by typing fragments. Letter case is ignored because people copy numbers inconsistently, but spaces, punctuation and hyphens have to match.

How it works in practice

You choose what the public sees

Core and custom fields each have their own visibility control. A fresh install publishes only the certificate number and its status, and you open up more from there.

A real status workflow

Valid, Suspended and Withdrawn are set by you; Expired is worked out from the expiry date. Restoring a historical expired record is handled separately and deliberately, so it cannot happen by accident.

Publish it six ways

A native WordPress block with six designs, a shortcode for the classic editor and other builders, direct links suitable for QR codes, and six optional Elementor widgets when Elementor is active.

Import, export and full backup

The CSV template is generated from your current fields. Partial updates leave untouched fields alone, blank cells preserve existing values unless you explicitly ask to clear them, and every row is validated before anything is written.

Built to stay private

Verification responses carry noindex and private-cache headers. There is no analytics, no telemetry, no remote scripts and no remote fonts. Certificate data never leaves your server.

Large registries stay quick

A dedicated indexed table, chunked imports, indexed prefetching and keyset exports keep memory and query pressure down as the registry grows.

How it works

Certificates live in their own indexed table rather than as posts, which is what keeps lookups fast and keeps the registry out of your content.

Verification works without JavaScript, announces results to screen readers, and rate limits repeated lookups. Access is controlled by a dedicated capability and an optional Certificate Manager role, so the person who issues certificates does not need to be an administrator.