Tracefern Image Check for C2PA

FAQ

How is this different from plugins that label AI images?

Many plugins look for C2PA or IPTC metadata and label an image as
AI-generated when they find it. Some count any C2PA manifest as AI, so a
camera photo with Content Credentials is labelled AI-generated. Others
read what the manifest claims without checking it, so an AI image that was
changed after signing keeps its label. Tracefern verifies first: a camera
photo stays a camera photo, and a changed image says “Does not verify” and
loses the label. It adds no badges to your pages; it gives you the verdict
a label can rely on.

What is the difference between “Verified” and “Intact”?

Both mean the file is exactly as it was signed. “Verified” also means the
signer’s certificate comes from an authority on the trust list, by default
the C2PA conformance programme’s list. “Intact” means nobody on that list
vouches for who the signer is.

Why does a genuine photo say “Does not verify”?

The file was changed after it was signed, for example by an editor that
kept the old Content Credentials but not the signature’s match with the
pixels. The details show the status codes; assertion.dataHash.mismatch
means the image data changed.

Why do most of my images show “No Content Credentials”?

Most cameras and apps do not add them yet, and many services remove them
when an image is shared or downloaded.

Does “AI-generated (signed)” detect AI images?

No. It shows what a verified manifest says about the image or the
earlier versions it was made from, each of which must verify too. An
AI image without Content Credentials gets no label. Next to “Intact: signer
not trusted” the claim comes from a signer nobody on the trust list vouches
for.

Does it change my images or send data anywhere?

No. It only reads the original file and stores the result with the image.
Settings → Privacy offers suggested text for your privacy policy.

Why does an image say “Check pending”?

The check runs in the background through WP-Cron, on the next request to
the site after the upload, usually within seconds. If WP-Cron is switched
off (DISABLE_WP_CRON), the checks run with the site’s own cron job.
After an hour without a result the image shows “Not checked”; check it
with wp tracefern check --unchecked.

Why does an image say “Changed since its check”?

Its file was replaced after the check by something WordPress did not
report, such as another plugin or an upload over FTP. The old verdict no
longer applies, so none is shown; check it again with
wp tracefern check . An image edited in WordPress’s own image
editor, or restored to its original, is checked again automatically. After
moving a site with a tool that does not keep file modification times, or
with media moved to external storage, every image can show this; check
them again with wp tracefern check --all.

Which formats are checked?

JPEG, PNG and WebP. HEIC files are converted to JPEG by the browser before
upload and arrive without their Content Credentials. Video and audio are
not checked.

How do I check images again after changing the trust settings?

With WP-CLI: wp tracefern check --all, or --state=Invalid,error,
or attachment IDs. Add --dry-run to see what would be checked.

Does it work on multisite?

Yes. Each site checks its own uploads and has its own settings. Deleting
the plugin removes its data from every site of the network, in one
request; on a network of thousands of sites, prefer WP-CLI.

Can other plugins use the verdict?

Yes, through a filter, with no dependency on this plugin:
apply_filters( ‘tracefern_verdict’, null, $attachment_id ). It returns
null when the plugin is not active or the ID is not an attachment, and
otherwise an array: status (checked, pending, not_checked,
changed, unreadable), state, intact, trusted, ai (true
exactly when the Media Library shows “AI-generated (signed)”), ai_edited
(the same for “AI-edited (signed)”), signer,
signed_at, codes and more. signer comes from the file: escape it
where you output it.

Why PHP 8.3?

The bundled verifier requires PHP 8.3 or later.