About this plugin
Verified, not just detected. Finding a C2PA manifest in a file is
easy; knowing whether it is genuine is not. A manifest can be copied onto
another image, and an image can be changed after it was signed while its
manifest still claims what it did before. Tracefern checks the signature,
the hash that ties the manifest to the image’s own bytes, and the signer’s
certificate against the C2PA trust lists. Only when the signature and the
hash hold does it show “AI-generated (signed)”, and only when the signer
is also on the trust list does it say “Verified”.
Content Credentials (C2PA) are a signed record inside a file: who
made or edited it, with which tool, and whether generative AI was used.
Tracefern verifies that record for every JPEG, PNG, GIF, WebP, WAV,
MP3, FLAC and plain text you upload and shows the verdict where you already work with media.
- Checked right after upload, on the original file, not on the
resized copies WordPress or your browser makes. The check runs in the
background, so a file that trips it up can never break an upload.
- A verdict per file in a Media Library column and in the attachment
details: who signed it, when, and against which trust list.
- “AI-generated (signed)” when a manifest that verifies says the image
was made by generative AI, also after later edits, and “AI-edited
(signed)” when AI edited it. Never on a file that does not verify.
- Sort and filter by verdict, AI-generated included, and see the
counts on the dashboard.
- Check existing files again under Settings → Tracefern or with WP-CLI.
The verdicts:
- Verified: trusted signer — the credentials verify and the signer’s
certificate chains to a trusted certificate authority.
- Intact: signer not trusted — the credentials verify, but the signer
is not on the trust list. The file is unchanged since signing; who
signed it is not vouched for.
- Does not verify — something failed, for example the image was
changed after signing. The details list the C2PA status codes.
- No Content Credentials — the file carries none. Most images today.
- Could not be checked — the file could not be read or the check did
not finish. The upload always proceeds.
What it does not do:
- It never signs anything and holds no keys.
- It never blocks an upload.
- It makes no network calls of its own. When another plugin has moved the
original image to cloud storage, the image is read through that plugin,
once per check. A manifest that is only referenced by URL is not
fetched, and trust lists are never downloaded.
Verification is done by
provemark/c2pa-verifier, a
C2PA verifier written in PHP, bundled with the plugin.
Development
The source code, the tests and the build are public at
com/provemark/tracefern-image-check. composer build makes the
plugin’s zip from it: it installs the bundled verifier and prefixes its
namespace with Strauss, so it cannot collide with another copy. The
com/provemark/c2pa-verifier.
Trust lists
By default the plugin trusts the certificate authorities on the C2PA
conformance programme’s trust lists, bundled with the plugin, and,
optionally, the DigiCert
Trusted Root G4 for timestamps. Settings → Tracefern shows the date of the
bundled copy and lets an administrator replace the lists with their own
trust settings. The plugin never downloads a list; a new copy comes with a
plugin update.
The C2PA trust lists are © the Coalition for Content Provenance and
com/c2pa-org/conformance-public,
0/).