CertiSprout – Certificate QR Verify for LearnDash

Yes. A quiz certificate gets its own code once the learner passes the quiz. Group certificates are not covered in this version.

Yes. Open https://your-site/?cert_verify= followed by the printed code. Capital letters, spaces and dashes are accepted, so the code can be typed exactly as it appears on the certificate.

The learner’s first and last name. If those are empty, it shows their display name, unless the display name is an email address or their username. In that case the page says “Certificate holder”. Developers can change the name with the psr_cqv_public_name filter.

The shortcode draws the code for the logged-in user. To test a layout, name a learner and a course in the shortcode, for example [cert_qr_verify user_id="12" course_id="34"] , or use quiz_id for a quiz. These attributes are ignored for anyone without the manage_options capability, and a code is still only created if that learner has completed the course.

Your verification link is longer than the largest QR code the plugin draws. The plugin then prints the code alone so the certificate can still be checked, and administrators see a short note asking for a shorter site address. A normal site address is well inside the limit.

For each certificate the plugin writes a small PNG to wp-content/uploads/cert-qr-verify/ , named with a keyed hash. The certificate links it as a root-relative path such as /wp-content/uploads/cert-qr-verify/NAME.png , so the PDF step reads it from disk instead of fetching it over HTTP.

The QR code is a file rather than an image embedded in the certificate because LearnDash rewrites image addresses that do not start with http or / . An embedded image would be left out of the PDF.

The folder and the link both come from wp_upload_dir() . The plugin has no filter of its own for them. What that means:

• Uploads in the default place, or moved with UPLOADS or the upload_dir filter to a folder inside the web root: the PNG is written there and the link follows. This works as long as the link path, added to the web root, is the real folder on disk.
• Uploads outside the web root, or a local path that does not match the URL path: the PNG is still written, but the link will not point at it. The QR code may then be missing from the PDF. This is a limit of this version, and we have not tested every host.
• Uploads served from a CDN or S3 bucket (for example with WP Offload Media): the plugin drops the host from the uploads URL and keeps only the path, so the PDF still looks on your own server. The PNG is written to the local uploads folder and is not added to the Media Library, so an offload plugin has nothing to copy. It works only while that local file exists at the same path under your web root. A host with a read-only disk will not.
• If the folder cannot be written, the QR code is embedded as a data image. The PDF then has no QR code, and the printed code under it, if shown, still verifies the certificate.

The verification page and the printed code do not depend on any of this.

Their code then shows “This certificate is no longer valid”. If they complete the course again, the same code shows as valid again.

Every code for that course shows “This certificate is no longer valid” until you publish it again or assign a certificate again.

The verification page keeps answering from the stored codes, so course certificates that were valid stay valid. No new codes are created until LearnDash is active again.

Their codes are deleted with them, and their certificates then show “Certificate not found”. On a single site their QR image files are deleted too. On a multisite network, see the next question.

Yes, with one limit. Each site keeps its own codes and its own cert-qr-verify folder.

Deleting a user from Network Admin deletes their codes on every site of the network, but it does not delete their QR image files. Those stay until you delete the plugin.

Network Admin only runs plugins that are network activated or active on the main site. If the plugin is active only on a sub-site, deleting a user from Network Admin runs none of its code at that moment. Once a day, each site that runs the plugin looks for codes whose user no longer exists and deletes them with their QR image files, so that sub-site clears the user’s codes within a day. WordPress runs this daily task when someone visits the sub-site, or from your server’s cron if you have set one up. Until then the verification page already shows “Certificate not found” for those codes, because the user no longer exists.

Users > Remove on a single site of the network only takes the user off that site, so their codes and QR files stay. Tools > Erase Personal Data covers the codes and QR files of the site you run it on.

No. The plugin makes no outside requests. Codes live in one table in your WordPress database, and the QR images sit in your own uploads folder.

For each certificate it stores the code, the learner’s user ID, the course or quiz ID, the completion date and the date the code was made. Anyone who has the code can see the learner’s name, the course or quiz title and the completion date on the verification page. The name never comes from their email address or username.

It also writes a QR image file for each certificate. The file holds only the verification link with the code, no name, and sits in wp-content/uploads/cert-qr-verify/ ( uploads/sites/N/cert-qr-verify/ on a multisite sub-site). The plugin adds suggested text for your privacy policy under Settings > Privacy > Policy Guide.

Yes. Tools > Export Personal Data includes the learner’s verification codes, course or quiz, dates and verification links. Tools > Erase Personal Data deletes their codes and their QR image files, and their certificates then show “Certificate not found”.

The plugin’s database table, its option, its daily clean-up task, its admin notice setting and the cert-qr-verify folder in uploads with every QR image in it. On a multisite network the table, option and folder are removed from every site.

Deleting the plugin deletes every verification code, so QR codes already printed on certificates then show “Certificate not found”. Deactivating the plugin keeps the codes.