Title: CertiSprout – Certificate QR Verify for LearnDash Author: pluginsprout Published: November 3, 2026 Last modified: November 3, 2026 --- Search plugins ![](https://ps.w.org/certisprout-certificate-qr-verify-for-learndash/assets/banner- 772x250.png?rev=3782400) ![](https://ps.w.org/certisprout-certificate-qr-verify-for-learndash/assets/icon- 256x256.png?rev=3782400) # CertiSprout – Certificate QR Verify for LearnDash By [pluginsprout](https://profiles.wordpress.org/pluginsprout/) [Download](https://downloads.wordpress.org/plugin/certisprout-certificate-qr-verify-for-learndash.1.0.6.zip) * [Details](https://wordpress.org/plugins/certisprout-certificate-qr-verify-for-learndash/#description) * [Reviews](https://wordpress.org/plugins/certisprout-certificate-qr-verify-for-learndash/#reviews) * [Installation](https://wordpress.org/plugins/certisprout-certificate-qr-verify-for-learndash/#installation) * [Development](https://wordpress.org/plugins/certisprout-certificate-qr-verify-for-learndash/#developers) [Support](https://wordpress.org/support/plugin/certisprout-certificate-qr-verify-for-learndash/) ## Description An employer, auditor or client holds a LearnDash certificate PDF and wants to know if it is real. They should not have to email you and wait for an answer. With this plugin they can verify a LearnDash certificate themselves. The certificate carries a QR code and a printed verification code. Scanning the QR code opens a certificate verification page on your own site. It works with the LearnDash certificates you already have. You add one shortcode to the certificate template. There is no new certificate builder and no settings screen. #### What does the person checking see? One of three answers. * **Valid certificate.** The page lists Awarded to (the learner’s name), Course( the course or quiz title) and Completed (the completion date in your site’s date format). * **Certificate not found.** The code was never issued, was mistyped, or belongs to a deleted user. Nothing about any learner is shown. * **This certificate is no longer valid.** The code was issued, but the certificate no longer stands. That happens when the course or quiz is no longer published or no longer has a certificate assigned, or when the learner no longer has the completion (for example after a progress reset). No name, course or date is shown. The page returns HTTP 200, 404 or 410 for these three answers, so a script can tell them apart. It is marked noindex as a header and a meta tag, and it is sent with no-cache headers. The only branding on it is your site name. #### How does it work? 1. A learner completes a course, or passes a quiz, that has a LearnDash certificate assigned. 2. The plugin stores a random verification code for that learner and that course or quiz. There is one code per learner per course or quiz. 3. You add `[cert_qr_verify]` to your certificate under LearnDash LMS > Certificates. 4. The certificate PDF shows the QR code with the code printed under it, as `Verify: XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX`. 5. The QR code links to `https://your-site/?cert_verify=CODE`. Learners who finished before you installed the plugin get a code the first time they open their certificate. The plugin first asks LearnDash whether the course really is complete, or the quiz really was passed, so the shortcode never creates a code for unfinished work. #### What is under the hood? * Each code is 32 characters from `random_bytes()`. Codes cannot be guessed or counted through, and every unknown code gets the same “Certificate not found” reply. * The QR code is drawn on your server by an encoder written for this plugin. No QR service is called and no learner data leaves your site. * The only admin notice appears on the Plugins screen when LearnDash is not active, and each administrator can dismiss it. #### What did we test? With WordPress 7.1.2 and LearnDash 5.1.10, we logged in as a learner, downloaded her certificate PDF and read its QR code with a standard QR reader. The link opened the page headed “Valid certificate”. The link with the printed code, capitals and dashes included, opened the same page, and a made-up code got “Certificate not found” with a 404. #### What does it not do? * It does not cover LearnDash group certificates in this version. * It does not add expiry dates, renewal reminders or badges. * It does not give visitors a search box. The check works through the QR code or the link. Every feature described here is in this plugin. Nothing is held back for a paid version. If your certificates also need an expiry date and renewal reminders, we sell a separate plugin for that: [Certificate Expiry for LearnDash](https://pluginsprout.com/downloads/certificate-expiry-for-learndash/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=cert-qr-verify). This plugin does not need it. ### Privacy Each QR image file holds only the verification link, `https://your-site/?cert_verify =CODE`, and no name. The files are in `wp-content/uploads/cert-qr-verify/` on your own server, one folder per site on a multisite network, and the plugin does not send them anywhere. They are deleted when: * You run Tools > Erase Personal Data for the learner. * You delete the user on a single site. * The daily clean-up finds codes whose user no longer exists, for example after a user was deleted from Network Admin while the plugin was active only on a sub- site. It deletes those codes and their QR files. * Someone opens the verification link of a revoked certificate (the course is unpublished or loses its certificate, or the learner loses the completion). Its QR file is deleted and the code row is kept. * The site address changes and the certificate is shown again, which replaces the old file with one for the new address. * You delete the plugin. Deleting a user from Network Admin on multisite removes their codes on every site but leaves their QR files until the plugin is deleted. On multisite, Users > Remove on a site only removes the user from that site, so it keeps their codes and QR files. If you change `AUTH_KEY` or `AUTH_SALT` in `wp-config.php`, the plugin no longer matches the older QR files by name, so they stay until you delete the plugin. A file left behind only encodes a link, and that link shows “Certificate not found” once the code is gone. ### Third party code The QR encoder in `includes/class-psr-cqv-qr.php` was written for this plugin and is released under GPLv2 or later with the rest of the plugin. It follows the public QR code specification (ISO/IEC 18004). No third party library is bundled. ## Screenshots [⌊A LearnDash certificate PDF with the QR code and verification code printed by [ cert_qr_verify].⌉⌊A LearnDash certificate PDF with the QR code and verification code printed by [cert_qr_verify].⌉[ A LearnDash certificate PDF with the QR code and verification code printed by `[ cert_qr_verify]`. [⌊Scanning the QR opens the verify page: "Valid certificate", with the learner's name, course and completion date.⌉⌊Scanning the QR opens the verify page: "Valid certificate", with the learner's name, course and completion date.⌉[ Scanning the QR opens the verify page: “Valid certificate”, with the learner’s name, course and completion date. [⌊When the course is unpublished or completion is reset, the code shows "This certificate is no longer valid" (HTTP 410).⌉⌊When the course is unpublished or completion is reset, the code shows "This certificate is no longer valid" (HTTP 410).⌉[ When the course is unpublished or completion is reset, the code shows “This certificate is no longer valid” (HTTP 410). [⌊An unknown or mistyped code shows "Certificate not found" (HTTP 404) and nothing about your learners.⌉⌊An unknown or mistyped code shows "Certificate not found" ( HTTP 404) and nothing about your learners.⌉[ An unknown or mistyped code shows “Certificate not found” (HTTP 404) and nothing about your learners. ## Installation 1. Install and activate LearnDash. 2. Go to Plugins > Add New > Upload Plugin, upload the plugin zip and activate it. Or unzip it and upload the plugin folder to `/wp-content/plugins/`. 3. Edit your certificate under LearnDash LMS > Certificates and add `[cert_qr_verify]` where the QR code should appear. 4. Open a certificate for a completed course to see the QR code. The certificate must be assigned to a course or quiz. Without one, the shortcode prints nothing and creates no code. Shortcode options: * `size`: QR image size in pixels. Default 120, kept between 40 and 600. * `show_code`: `yes` (default) prints the code under the QR code, `no` hides it. Example: `[cert_qr_verify size="150" show_code="no"]` ## FAQ ### Does it work with quiz certificates? Yes. A quiz certificate gets its own code once the learner passes the quiz. Group certificates are not covered in this version. ### Can someone check a code without scanning it? Yes. Open `https://your-site/?cert_verify=` followed by the printed code. Capital letters, spaces and dashes are accepted, so the code can be typed exactly as it appears on the certificate. ### Which name does the verification page show? The learner’s first and last name. If those are empty, it shows their display name, unless the display name is an email address or their username. In that case the page says “Certificate holder”. Developers can change the name with the `psr_cqv_public_name` filter. ### How do I preview the QR code as an administrator? The shortcode draws the code for the logged-in user. To test a layout, name a learner and a course in the shortcode, for example `[cert_qr_verify user_id="12" course_id ="34"]`, or use `quiz_id` for a quiz. These attributes are ignored for anyone without the manage_options capability, and a code is still only created if that learner has completed the course. ### Why does my certificate show only the code and no QR image? Your verification link is longer than the largest QR code the plugin draws. The plugin then prints the code alone so the certificate can still be checked, and administrators see a short note asking for a shorter site address. A normal site address is well inside the limit. ### Where does the QR image come from, and does it work with a custom uploads folder or an offloaded media library? For each certificate the plugin writes a small PNG to `wp-content/uploads/cert-qr- verify/`, named with a keyed hash. The certificate links it as a root-relative path such as `/wp-content/uploads/cert-qr-verify/NAME.png`, so the PDF step reads it from disk instead of fetching it over HTTP. The QR code is a file rather than an image embedded in the certificate because LearnDash rewrites image addresses that do not start with `http` or `/`. An embedded image would be left out of the PDF. The folder and the link both come from `wp_upload_dir()`. The plugin has no filter of its own for them. What that means: * Uploads in the default place, or moved with `UPLOADS` or the `upload_dir` filter to a folder inside the web root: the PNG is written there and the link follows. This works as long as the link path, added to the web root, is the real folder on disk. * Uploads outside the web root, or a local path that does not match the URL path: the PNG is still written, but the link will not point at it. The QR code may then be missing from the PDF. This is a limit of this version, and we have not tested every host. * Uploads served from a CDN or S3 bucket (for example with WP Offload Media): the plugin drops the host from the uploads URL and keeps only the path, so the PDF still looks on your own server. The PNG is written to the local uploads folder and is not added to the Media Library, so an offload plugin has nothing to copy. It works only while that local file exists at the same path under your web root. A host with a read-only disk will not. * If the folder cannot be written, the QR code is embedded as a data image. The PDF then has no QR code, and the printed code under it, if shown, still verifies the certificate. The verification page and the printed code do not depend on any of this. ### What happens if I reset a learner’s progress? Their code then shows “This certificate is no longer valid”. If they complete the course again, the same code shows as valid again. ### What happens when I unpublish a course or remove its certificate? Every code for that course shows “This certificate is no longer valid” until you publish it again or assign a certificate again. ### What happens if LearnDash is deactivated? The verification page keeps answering from the stored codes, so course certificates that were valid stay valid. No new codes are created until LearnDash is active again. ### What happens when I delete a user? Their codes are deleted with them, and their certificates then show “Certificate not found”. On a single site their QR image files are deleted too. On a multisite network, see the next question. ### Does it work on a multisite network? Yes, with one limit. Each site keeps its own codes and its own `cert-qr-verify` folder. Deleting a user from Network Admin deletes their codes on every site of the network, but it does not delete their QR image files. Those stay until you delete the plugin. Network Admin only runs plugins that are network activated or active on the main site. If the plugin is active only on a sub-site, deleting a user from Network Admin runs none of its code at that moment. Once a day, each site that runs the plugin looks for codes whose user no longer exists and deletes them with their QR image files, so that sub-site clears the user’s codes within a day. WordPress runs this daily task when someone visits the sub-site, or from your server’s cron if you have set one up. Until then the verification page already shows “Certificate not found” for those codes, because the user no longer exists. Users > Remove on a single site of the network only takes the user off that site, so their codes and QR files stay. Tools > Erase Personal Data covers the codes and QR files of the site you run it on. ### Does it send data anywhere? No. The plugin makes no outside requests. Codes live in one table in your WordPress database, and the QR images sit in your own uploads folder. ### What personal data does it store, and who can see it? For each certificate it stores the code, the learner’s user ID, the course or quiz ID, the completion date and the date the code was made. Anyone who has the code can see the learner’s name, the course or quiz title and the completion date on the verification page. The name never comes from their email address or username. It also writes a QR image file for each certificate. The file holds only the verification link with the code, no name, and sits in `wp-content/uploads/cert-qr-verify/` (` uploads/sites/N/cert-qr-verify/` on a multisite sub-site). The plugin adds suggested text for your privacy policy under Settings > Privacy > Policy Guide. ### Does it work with the WordPress export and erase personal data tools? Yes. Tools > Export Personal Data includes the learner’s verification codes, course or quiz, dates and verification links. Tools > Erase Personal Data deletes their codes and their QR image files, and their certificates then show “Certificate not found”. ### What is removed when I delete the plugin? The plugin’s database table, its option, its daily clean-up task, its admin notice setting and the `cert-qr-verify` folder in uploads with every QR image in it. On a multisite network the table, option and folder are removed from every site. Deleting the plugin deletes every verification code, so QR codes already printed on certificates then show “Certificate not found”. Deactivating the plugin keeps the codes. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “CertiSprout – Certificate QR Verify for LearnDash” is open source software. The following people have contributed to this plugin. Contributors * [ pluginsprout ](https://profiles.wordpress.org/pluginsprout/) [Translate “CertiSprout – Certificate QR Verify for LearnDash” into your language.](https://translate.wordpress.org/projects/wp-plugins/certisprout-certificate-qr-verify-for-learndash) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/certisprout-certificate-qr-verify-for-learndash/), check out the [SVN repository](https://plugins.svn.wordpress.org/certisprout-certificate-qr-verify-for-learndash/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/certisprout-certificate-qr-verify-for-learndash/) by [RSS](https://plugins.trac.wordpress.org/log/certisprout-certificate-qr-verify-for-learndash/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.6 * The plugin is now called CertiSprout – Certificate QR Verify for LearnDash, with the text domain certisprout-certificate-qr-verify-for-learndash. * The verification page now loads its styles through WordPress (a registered stylesheet, with the status colour added inline) instead of a style tag in the page. * The Privacy Policy Guide entry for the plugin now appears under the new name. * Certificate PDFs and existing codes are unchanged. #### 1.0.5 * Fix: on multisite, network-deactivating the plugin now only touches the sites of the network it was deactivated on. On WordPress 6.1 and later it also clears the in-memory cache after each group of 100 sites. It stops after 1,000 sites so it finishes in time. On a larger network the remaining sites keep a clean- up task that does nothing. * Hardening: the verification page is now escaped as it is printed, and the code in the verification link is sanitised as it is read. * Certificate PDFs and existing codes are unchanged. #### 1.0.4 * Fix: on multisite, network-deactivating the plugin now removes its daily clean- up task from every site. Before, only the main site lost it, and the other sites kept a scheduled task that did nothing until the plugin was deleted. #### 1.0.2 * Fix: on multisite, when the plugin is active only on some sub-sites, a user deleted from Network Admin no longer leaves codes behind on those sites. A daily clean- up on each site deletes codes whose user no longer exists, with their QR image files. * Fix: when `[cert_qr_verify]` is shown on a web page, the QR code now lines up with the verification code under it on left-aligned themes. It was about 10 px to the right because of the white border the QR image needs for scanning. The border is kept. * The printed LearnDash certificate PDF is unchanged. #### 1.0.1 * Fix: when `[cert_qr_verify]` is shown on a web page, the verification code now sits close under the QR code instead of far below it. The exact gap depends on the theme. * The printed LearnDash certificate PDF is unchanged: the QR code and the verification code print exactly as in 1.0.0. #### 1.0.0 * New: the `[cert_qr_verify]` shortcode prints a QR code and a verification code on LearnDash course and quiz certificates. * New: a public verification page at `?cert_verify=CODE` shows the learner’s name, the course and the completion date, or “Certificate not found”. * New: a certificate shows “This certificate is no longer valid” if the course is unpublished, its certificate is removed, or the learner loses the completion. * New: codes are only issued for a course or quiz that has a certificate assigned. * New: the verification page never shows the learner’s email address or username. It shows their first and last name, or their display name, or “Certificate holder”. The `psr_cqv_public_name` filter can change it. * New: learners who finished before you installed the plugin get a code the first time they open their certificate. * New: verification codes are included in WordPress personal data export and erase requests, and the plugin adds suggested text to the Privacy Policy Guide. * New: on multisite, deleting a user from the network deletes their codes on every site, and deleting the plugin removes its table from every site. * QR codes are drawn on your own server. No outside service is called. ## Meta * Version **1.0.6** * Last updated **8 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [certificate](https://wordpress.org/plugins/tags/certificate/)[certificate verification](https://wordpress.org/plugins/tags/certificate-verification/) [learndash](https://wordpress.org/plugins/tags/learndash/)[qr code](https://wordpress.org/plugins/tags/qr-code/) [verification](https://wordpress.org/plugins/tags/verification/) * [Advanced View](https://wordpress.org/plugins/certisprout-certificate-qr-verify-for-learndash/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/certisprout-certificate-qr-verify-for-learndash/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/certisprout-certificate-qr-verify-for-learndash/reviews/) ## Contributors * [ pluginsprout ](https://profiles.wordpress.org/pluginsprout/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/certisprout-certificate-qr-verify-for-learndash/)