C2PA Content Credentials on WordPress

01What are Content Credentials?

Any C2PA WordPress setup starts with knowing what you are trying to preserve. Content Credentials are signed provenance records for digital content, defined by the C2PA (Coalition for Content Provenance and Authenticity) specifications. The C2PA explainer describes a Content Credential, also called a C2PA Manifest, as a cryptographically bound structure that records an asset's provenance through assertions about its origin, its edits and its use of AI. A camera, an editing app or a generative tool signs the manifest, and a validator can later confirm that neither the asset nor its record has changed since signing.

The explainer is careful about what that proves. Credentials say whether provenance information is well formed, untampered and signed by a known signer; they make no judgment about whether the content is true. For the full background on the standard, see this complete guide to C2PA. This page stays with the C2PA WordPress question: what happens to a credential once the file is in your media library.

Two more points from the explainer shape how a site should treat credentials. Adding provenance is optional, and the explainer says media without Content Credentials should not be treated as less trustworthy on that basis alone. Provenance can also be incomplete: if an image is cropped in a tool that does not support Content Credentials, the record may not reflect that step. A credential is evidence about a file's history, not a verdict on it.

Content Credentials also work alongside the metadata formats WordPress users already know. The explainer says they are used in conjunction with IPTC, XMP and EXIF, and that the specification maps those formats into assertions so the values become tamper-evident once signed. That is why a generated image can carry both a plain IPTC label and a signed C2PA record of the same fact.

02Does WordPress strip C2PA data from images?

WordPress does not serve one image. When you upload a photo, it resizes it into several copies for different layouts, and a page will often display one of those copies rather than the file you uploaded. Each copy is a newly encoded file.

The WordPress developer reference documents what happens to metadata on that resize. The image_strip_meta filter controls whether metadata is stripped when images are resized, with a default of true, and the reference adds that the filter only applies to the Imagick editor because the GD editor always strips profiles by default. The reference does not mention C2PA by name, but an embedded manifest is stored in the file alongside its other metadata, so expect resized copies to arrive without it and check rather than assume.

Turning stripping off does not fully solve the problem. A manifest's hard binding is a cryptographic hash of the content at signing time, and the C2PA explainer says validation confirms the asset has not been modified since the manifest was created. A resized copy has different pixels, so a manifest copied into it would no longer match.

03Keeping manifests: a C2PA WordPress workflow

Since WordPress resizing breaks the binding, the workable strategy is to keep the signed original reachable and make its manifest easy to find. The C2PA specification supports this with external manifests: a manifest store kept outside the asset, served with the media type application/c2pa, and located by reference.

The specification lists the places a validator should look when no manifest is embedded. In order: an HTTP Link header with rel=c2pa-manifest, a dcterms:provenance URI in the asset's XMP, and then a file at the same path with .c2pa added, such as image.jpg.c2pa, or with the extension replaced, such as image.c2pa. That last convention suits WordPress well, because a sidecar file can sit in the uploads folder next to the original.

1. Sign the image in a C2PA-aware tool before upload, and keep that signed file as your master copy outside WordPress.
2. Upload the image and link to the full-size original from the post, for example from the caption, so readers and validators can reach the signed file.
3. If your tool can export the manifest store separately, upload it next to the original with the .c2pa naming convention, and make sure the server sends it with the application/c2pa media type.
4. For sites with server access, add a Link header with rel=c2pa-manifest on the original's URL pointing at the manifest store.

Which option fits depends on how much control you have. On shared hosting without access to response headers, the sidecar convention and a visible link to the original are usually the only practical routes. On a managed server, the Link header is the most explicit signal, because it ties the manifest to the exact URL a validator fetched. Whichever you choose, keep the signed master outside WordPress so that a plugin, a migration or an accidental re-upload cannot overwrite the only verifiable copy.

Check the served result after each change. Caching plugins, image optimization services and CDNs may recompress or convert the original too, and anything that rewrites the file changes what a validator sees.

04How do you show credentials to readers?

Most readers will never run a validator, so the page itself has to say that credentials exist. A short caption line works: name the source, state whether the image was generated or edited with AI, and link to the signed original. Keep it consistent with any disclosure pattern for AI-assisted posts you already use, so text and images follow the same rules.

Search engines are starting to surface this data too. Google's image metadata documentation says that if an image contains C2PA metadata, Google can extract it and may show it in the About this image feature, such as how the image was created or whether it was edited with AI tools. That applies when the signer has adopted C2PA version 2.1 or later and the manifest is signed by a certificate from a certification authority on the C2PA Trust List.

Structured data cannot carry a credential, but it can describe the image honestly. If the image is generated or AI-edited, the IPTC field is the label most tools write today; see the IPTC digital source type field. In JSON-LD, point contentUrl at the original file and keep any digitalSourceType value identical to the embedded one.

1{2  "@context": "https://schema.org",3  "@type": "ImageObject",4  "contentUrl": "https://example.com/uploads/example-harbour-original.jpg",15  "caption": "Example Harbour at dawn. Signed original with Content Credentials.",6  "creator": {7    "@type": "Person",8    "name": "Example Photographer"9  },10  "creditText": "Example Photographer / Example Publisher",11  "copyrightNotice": "Example Publisher",12  "digitalSourceType": "https://schema.org/DigitalCaptureDigitalSource"213}

05How do you verify credentials after upload?

Verification means fetching the file a visitor actually receives and checking it with a C2PA-aware validator. Do this from the public URL, not from the copy on your computer, because the point is to test what WordPress and any optimization layer delivered.

1. Open the published post and note which image URL the page uses; it is usually a resized copy.
2. Run that file through a C2PA-aware validator; expect no credential on a resized copy.
3. Run the full-size original's URL through the same validator; this file should validate.
4. If you rely on a sidecar, request the .c2pa URL directly and confirm it loads and is not blocked or cached as HTML.
5. Repeat after changing image, cache or CDN settings.

If a validator reports that a referenced manifest cannot be reached, the C2PA specification defines the error code manifest.inaccessible for that case, which usually means the sidecar or linked URL moved. The explainer also notes that provenance metadata can be removed, which is why C2PA defines soft bindings such as invisible watermarks and fingerprints that let a validator find a manifest stored in the cloud even after the file lost it.

Images are only one part of the picture. If you are wondering what does structured data have to do with images, the answer starts with describing them accurately: see what does structured data have to do with images? on the handbook home, and the authenticity section for the other provenance signals.