Automated Email Notifications

Attestation Core sends compliance emails for you, so nobody has to keep a spreadsheet of who needs chasing. A daily background check finds documents that are about to expire, have expired or are due for their annual review, and emails the staff member concerned. Evidence and plan decisions send an email the moment they happen. Every email is recorded in a notification log so you can show what was sent, to whom and when.

This guide is for site administrators and compliance managers. Staff members don’t configure anything. They just receive the emails at the address on their compliance profile.

Overview

• Who receives what: each notification goes either to the staff member (the email on their compliance profile, or their WordPress account email if the profile has none) or to the admin contact email (Settings → General → Admin contact email, falling back to the WordPress site admin email).
• How it’s sent: through WordPress’s normal mail function, as plain text. The “From” name is your organisation name (Settings → General) and the “From” address is the admin contact email. On most hosts you should install an SMTP plugin (for example FluentSMTP or WP Mail SMTP) so these emails are delivered reliably.
• Where to configure it: Attestation Core → Settings → Notifications.
• Where to check it: Attestation Core → Notifications (the Notification Log).

Free includes six email types: one reminder for each document state, plus the evidence workflow. Pro adds the 90, 60 and 7-day expiry reminders, plan lifecycle emails, the RTO credential working-towards warning, RTO milestone and validation panel reminders, escalation emails, and an optional SMS channel.

When notifications are sent

The daily check

When the plugin is activated, it schedules a daily background task. The first run is set for 02:00 the next day and later runs follow every 24 hours. WordPress works these times out in UTC, so 02:00 UTC is around midday or early afternoon in eastern Australia. To see exactly when the next run is due, go to Settings → General → System status → Daily background task (“Scheduled. Next run: …”). If it says Not scheduled, deactivate and reactivate the plugin to reschedule it.

The daily task runs through WordPress’s built-in scheduler (WP-Cron), which only starts when someone visits the site. On a very quiet site the run can be late. Many hosts let you set up a real server cron job that calls WP-Cron to make the timing dependable.

Each run works in this order:

1. Recalculate document statuses. Each document is placed in a window based on its expiry date: Current, Expiring in ≤90, ≤60, ≤30 or ≤7 days, Expired, or Annual review due (for “rolling annual” document types, once 12 months have passed since the issue date or the configured review date has gone by).
2. Send the Free document emails: the 30-day reminder, the expired notice and the annual-review-due notice.
3. Send the Pro document emails (Pro only): the 90, 60 and 7-day reminders, plus the credential working-towards warning on RTO sites.
4. Run escalations (Pro only). See Escalation workflows below.

A lock prevents the same run from being processed twice if WP-Cron starts it twice. Only documents whose type is required for the staff member’s workforce type are included, so a staff member isn’t chased for a document their role doesn’t need.

Repeat behaviour: the plugin won’t send the same email about the same document more than once in 20 hours. That window stops duplicates within a single day. It does not stop the next day’s run. While a document stays in the same window (for example, between 30 and 8 days before expiry), the matching reminder goes out again on each daily run until the document is renewed or moves into the next window. If that is more than you want, untick that notification type, or edit its wording so repeat reminders read naturally.

Event emails (evidence submitted, validated or returned, and plan status changes) are sent the moment the action happens. The 20-hour window doesn’t apply to them, so each decision always produces an email.

Every email type

“Editable” means the subject and body can be changed under Settings → Notifications.

Email	Tier	Trigger	Recipient	Default subject	Editable
Document expiring in 30 days	Free	Daily check: document is 30 to 8 days from expiry	Staff member	[{{organisation_name}}] {{document_type}} expires in 30 days — action required	Yes
Document expired	Free	Daily check: expiry date has passed	Staff member	[{{organisation_name}}] {{document_type}} has expired	Yes
Annual review document due	Free	Daily check: rolling-annual document is due for review	Staff member	[{{organisation_name}}] {{document_type}} annual review due	Yes
Evidence submitted (admin alert)	Free	A staff member submits evidence	Admin contact email	[{{organisation_name}}] New evidence awaiting validation — {{trainer_name}}	Yes
Evidence validated	Free	An admin validates evidence	Staff member	[{{organisation_name}}] Your evidence has been validated	Yes
Evidence returned for revision	Free	An admin returns evidence with a comment	Staff member	[{{organisation_name}}] Your evidence has been returned for revision	Yes
Document expiring in 90 days	Pro	Daily check: 90 to 61 days from expiry	Staff member	[{{organisation_name}}] {{document_type}} expires in 90 days	Yes
Document expiring in 60 days	Pro	Daily check: 60 to 31 days from expiry	Staff member	[{{organisation_name}}] {{document_type}} expires in 60 days	Yes
Document expiring in 7 days	Pro	Daily check: 7 days or fewer from expiry	Staff member	[{{organisation_name}}] {{document_type}} expires in 7 days — urgent action required	Yes
Development plan submitted	Pro	A staff member submits their annual plan	Admin contact email	[{{organisation_name}}] Annual plan submitted — awaiting review	Yes
Development plan approved	Pro	An admin approves a plan	Staff member	[{{organisation_name}}] Annual plan approved	Yes
Development plan returned for revision	Pro	An admin returns a plan	Staff member	[{{organisation_name}}] Annual plan returned for revision	Yes
Credential working-towards 2-year limit (RTO)	Pro, RTO only	Daily check: a working-towards credential is within 90 days of the 2-year limit, or past it	Staff member	[{{organisation_name}}] Credential working-towards limit approaching — {{trainer_name}}	Yes
RTO compliance milestone upcoming	Pro, RTO only	Separate daily check: milestone due within 30 days	Assigned staff member	[{{organisation_name}}] RTO compliance milestone due in {{days_out}} days — {{event_title}}	Yes
RTO compliance milestone overdue	Pro, RTO only	Separate daily check: milestone past due	Assigned staff member	[{{organisation_name}}] RTO compliance milestone overdue — {{event_title}}	Yes
Validation panel upcoming	Pro, RTO only	Separate daily check: panel scheduled within 30 days	Panel chair	[{{organisation_name}}] Validation panel scheduled in {{days_out}} days — {{panel_title}}	Yes
Validation panel overdue	Pro, RTO only	Separate daily check: scheduled date passed and panel not completed	Panel chair	[{{organisation_name}}] Validation panel overdue — {{panel_title}}	Yes
Escalation (supervisor)	Pro	Daily check: document still expired after the escalation threshold	The staff member’s supervisor	[Organisation] Escalation: {Document type} expired for {Staff name}	No
Escalation (admin)	Pro	As above	Admin contact email	[Organisation] Escalation: {Document type} expired for {Staff name}	No
Test email	Free	You click Send test email	Admin contact email	[Organisation] Attestation Core test email	No

A few notes:

• Free has no 7-day email. On Free, a document that is 7 days or fewer from expiry gets no further reminder until it actually expires. Pro adds the 7-day email.
• Plan submitted goes to the admin contact email, even though the shipped wording thanks the staff member. If you want it to read as an admin alert, edit the body.
• The credential working-towards warning goes to the staff member, even though the shipped body begins “This is an administrator notification” and the General tab says the admin contact email receives credential alerts. Edit the body to suit the staff member, or untick it and use the Under Direction Register report to monitor working-towards credentials yourself.
• RTO milestone and validation panel reminders run on their own daily schedule, not the main daily check, and are only sent to an assigned person or panel chair. The current admin screens have no field for choosing one. That means these reminders are logged as Failed — No recipient email available in the Notification Log. See RTO milestones and validation panels.
• On Pro sites the Notifications tab also lists some types that no feature sends yet: plan due/overdue reminders, staff upskilling plan reminders, the fixed-day milestone and panel cadences, and unit validation reminders. Some show their internal name instead of a friendly label. Ticking or editing them has no effect for now.

Turning emails on or off and editing templates

Go to Attestation Core → Settings → Notifications. You need the “manage settings” permission, which administrators have.

1. Send test email (at the top of the tab) sends a message to your admin contact email so you can confirm your site can send mail. If no admin contact email is set, you’ll see “No admin contact email is configured. Set one under Settings → General first.”
2. Master switch → Send notification emails (default: on). Turning it off blocks every notification, whatever the per-type settings say. The log keeps showing previous sends.
3. Per-notification enable + template: each row has a Send? checkbox (default: ticked for every type), the recipient (“Recipient: admin” or “Recipient: staff member”), a Subject field and a Body field.
4. Leave a field blank to use the shipped default. Open Show shipped default to see the original wording. For Pro types, the shipped default may not appear in this panel. A blank field still uses the Pro default.
5. Reset to default clears your custom subject and body for that type, after you confirm.
6. Click Save notification settings.

Subjects and bodies are plain text. Formatting and HTML are removed when you save.

Template tokens

Type a token in double curly braces, for example {{document_type}}. Unknown tokens, or tokens that have no value for that email, are replaced with nothing, so stray braces never reach a staff member.

Available in every email:

Token	Value
{{organisation_name}} / {{rto_name}}	Organisation name from Settings → General (falls back to the site name)
{{admin_email}}	Admin contact email
{{site_url}}	Your site’s home address
{{site_name}}	WordPress site title
{{rto_logo_url}}	Pro: your logo’s web address, when a logo is set under Branding. Emails are plain text, so this appears as a link, not an image.

Depends on the email:

Token	Available in
{{trainer_name}}	Document, evidence, plan and credential emails (the staff member’s name)
{{document_type}}, {{expiry_date}}	Document emails
{{evidence_type}}, {{evidence_title}}, {{evidence_date}}	Evidence emails
{{reviewer_name}}	Evidence validated/returned, plan approved/returned (the admin who acted)
{{admin_comment}}	Evidence validated/returned, plan returned
{{plan_year}}, {{due_date}}	Plan emails (Pro)
{{credential_name}}, {{start_date}}	Credential working-towards warning (Pro, RTO)
{{event_title}}, {{category}}, {{due_date}}, {{days_out}}	RTO milestone emails (Pro)
{{panel_title}}, {{scheduled_date}}, {{status}}, {{days_out}}	Validation panel emails (Pro)

{{plan_status}} appears in the token list on the settings page, but no email currently supplies a value for it, so it comes out blank.

Notification log

Go to Attestation Core → Notifications (page title Notification Log). It’s visible to users with the “manage settings” permission, which administrators have by default.

• The log lists every notification the plugin has tried to send, newest first, 25 per page.
• Columns: Sent (date and time), Type, Recipient, Subject, Status.
• Status is Sent or Failed. Failed rows show the reason. The common ones are “No recipient email available” (the staff member has no valid email on their profile or WordPress account) and “wp_mail returned false” (your site’s mail system refused the message, which usually means SMTP isn’t set up).
• Filter by type: choose a notification type and click Filter. Escalation emails are logged with their internal names (document_escalation_supervisor / document_escalation_admin) and can’t be chosen from the filter list. Use All types to see them.
• Pro SMS messages also appear here (see below), with an empty recipient and subject.

De-duplication window: before sending a daily-check email, the plugin looks in this log for a successful send of the same type about the same document (or credential, milestone or panel) within the last 20 hours. If it finds one, it skips the send. Failed sends don’t count, so a failure is retried on the next run. Escalations use a much longer window (see below). Event emails (evidence and plan decisions) skip this check.

The log is kept when you delete the plugin, unless you first tick Settings → Advanced → Remove all plugin data on uninstall. When a staff member’s personal data is erased, identifying fields on their log rows are cleared. See Privacy, security and data.

Escalation workflows

🔒 Pro feature — requires the Pro plugin.

Escalations make sure an expired document doesn’t sit unnoticed. If a document is still expired a set number of days after its expiry date, the plugin emails the staff member’s supervisor and/or your admin contact email.

Where: Attestation Core → Settings → Escalations (Pro). You need the “manage settings” permission.

Setting	What it does	Default
Enable escalations (“Run escalation checks each day”)	Turns the escalation check on or off	On
Send to trainer supervisor (when assigned)	Emails the person chosen in the Supervisor field on the staff member’s compliance profile. Skipped if no supervisor is set or the supervisor has no valid email.	On
Send to admin email	Emails the admin contact email from Settings → General	On
Default threshold (days)	How many days after expiry before escalating, for any document type without its own value. Allowed range 1–365.	14
Per-document-type thresholds → Escalate after (days)	A threshold for each document type, shown with its expiry model (Fixed expiry date, Annual review, No expiry). Types still using the default say “Currently using default threshold.” Range 1–365.	The default threshold

Click Save escalation settings.

How it runs: escalation is the last step of the daily check, after the standard expiry emails. It only looks at documents whose status is Expired and that have an expiry date. A document escalates once the number of days since its expiry date reaches the threshold for its type. Annual-review documents with no expiry date never escalate. If both recipient options are unticked, the check doesn’t run.

How often: each document escalates at most once a year per recipient (supervisor and admin are tracked separately). The plugin only remembers successful sends, so a failed email is retried the next day.

The email: subject “[Organisation] Escalation: {document type} expired for {staff name}”. The body lists the staff member, document type, expiry date, days overdue, the escalation threshold and the recipient’s role (“Supervisor” or “Administrator”), and asks the recipient to follow up. This wording can’t be edited in the settings. Outcomes appear in the Notification Log.

If the Pro licence becomes inactive (after the grace period), the escalation check stops running. Free sites don’t have this tab.

SMS notifications

🔒 Pro feature — requires the Pro plugin.

Pro can send a short text message through your own Twilio account alongside chosen email notifications. SMS is off by default and opt-in in two ways: you choose which notification types send SMS, and only staff members with a mobile number on file receive one.

Where: Attestation Core → Settings → SMS (Pro).

Setting	What it does	Default
Enable SMS (“Send SMS notifications via Twilio”)	Master switch for the SMS channel	Off
Twilio Account SID	Your Twilio Account SID (starts with AC…). Stored encrypted. Once saved, the field shows “A credential is saved. Enter a new value to replace it.”	Blank
Twilio Auth Token	Your Twilio Auth Token. Stored encrypted and never shown again after saving.	Blank
From Number	Your Twilio phone number in E.164 format, e.g. +61412345678. Anything other than digits and “+” is removed.	Blank
Enable SMS per notification type	A Send SMS checkbox for each notification type the plugin actually sends	All unticked

Click Save SMS settings. Then use Send a Test SMS: enter a number in E.164 format and click Send test SMS. The test message reads “This is a test message from Attestation Core Pro.” You’ll see “Test SMS sent successfully.” or “Test SMS failed. Check your Twilio credentials and the recipient number.” Save your credentials before testing.

Staff opt-in: on each staff member’s compliance profile, Pro adds a Mobile (SMS alerts) field in E.164 format. Leave it blank to opt that person out. Staff members without a number never get an SMS.

Which events send SMS: any notification type ticked in the list. That covers the document reminders, evidence and plan emails, the credential warning, and milestone and panel reminders. The SMS is sent to the staff member linked to that notification. Escalation emails and the test email never produce an SMS. An admin-addressed email (such as “Evidence submitted”) sends its SMS to the staff member the event is about, not to the admin, so you’ll usually leave those types unticked.

What the message says: every SMS uses the same text, “Compliance alert ({notification type}) from {site name}. Please log in to review.”, where the notification type appears as its internal name (for example document_expiry_30). There is no screen for changing this text. Messages are kept to a single 160-character segment, and anything longer is cut short and ends with “… [login for details]”.

How it’s sent (the send-SMS task): when an SMS-enabled email is processed, the plugin doesn’t call Twilio straight away. It queues a one-off background task that runs on the next WP-Cron run, so a slow Twilio response never holds up an admin screen. Repeat requests for the same staff member and type within about 10 minutes merge into one. The SMS is sent whether or not the matching email succeeded.

What goes to Twilio: your Account SID and Auth Token (to sign in), your From Number, the staff member’s mobile number and the message text above. No names, document details or email addresses are sent.

Logging: each successful SMS adds a row to the Notification Log with the notification type and status “Sent”, but no recipient or subject. Failed SMS sends aren’t logged, so if messages don’t arrive, use the test SMS and check your Twilio console.

Twilio charges your account per message. SMS is for short alerts only. Bulk or marketing SMS isn’t supported.

Worked example

A childcare centre uses Attestation Core Free. Its “First Aid Certificate” document type has a fixed expiry date. Educator Priya’s certificate expires on 31 October.

• Around 1 October, Priya’s certificate moves into the ≤30-day window. On the next daily run she gets “[Sunnyside Early Learning] First Aid Certificate expires in 30 days — action required”. She gets the same reminder each day until it’s renewed or until 24 October, when it moves into the ≤7-day window. Free sends nothing during that last week.
• If she hasn’t renewed by 1 November, she gets “First Aid Certificate has expired” on each daily run until a new certificate is uploaded.
• The director checks Attestation Core → Notifications, filters by “Document expired”, and sees each send with its timestamp. That’s useful evidence of follow-up at an inspection.

With Pro, Priya would also get the 90, 60 and 7-day reminders. Fourteen days after expiry (the default threshold), her room leader (set as her supervisor) and the director’s admin inbox would each receive one escalation email. With SMS set up and “Document expired” ticked, Priya would also get a text.

Troubleshooting

• No emails at all. Check that Send notification emails is on, then click Send test email. If the test doesn’t arrive, your site can’t send mail. Install and configure an SMTP plugin.
• Log shows “Failed — No recipient email available”. The staff member’s profile has no valid email and they have no linked WordPress account. Add an email on their compliance profile. For RTO milestone and validation panel reminders, see the note in the table above.
• Log shows “Failed — wp_mail returned false”. WordPress couldn’t hand the message to your mail server. Check your SMTP plugin’s own log.
• Daily emails stopped. Check Settings → General → System status. If the daily background task says “Not scheduled”, deactivate and reactivate the plugin. On low-traffic sites, set up a server cron job so WP-Cron runs reliably.
• Staff get the same reminder every day. That’s how it’s designed while a document stays in the same window (see “Repeat behaviour” above). Untick that type or adjust its wording.

Related guides: Document management, Evidence submission, Annual plans, Settings, Webhooks.