← Back to Attestation Core Changelog

Settings Reference

A tab-by-tab reference for every Attestation Core setting, Free and Pro: the label you see on screen, what it does, its default and the values it accepts. For step-by-step guidance, follow the links to the feature guides.

Where settings live

The settings page

All plugin settings are under Attestation Core → Settings in the WordPress admin (page heading Attestation Core Settings). Opening the page requires the plugin’s manage settings permission. Administrators have it by default.

The tabs run left to right in the order you normally configure things: setup first, then communications, then customisation and system tabs.

Tab	Free / Pro	What it covers
General	Free	Industry, organisation details, admin email, plan due date, currency threshold, declaration text, system status
Branding (Pro)	Pro	Organisation logo and brand colour
Library	Free	Three sub-tabs: Document types, Evidence categories, Workforce types
Portal pages	Free	Which WordPress page holds each staff-portal shortcode
Notifications	Free	Email on/off switches, editable templates, test email
Escalations (Pro)	Pro	Escalating long-expired documents
SMS (Pro)	Pro	Twilio text-message alerts
Scheduled Reports (Pro)	Pro	Recurring emailed PDF reports
Webhooks (Pro)	Pro	Outgoing event notifications to other systems
Labels	Free	Overriding the words the plugin uses. Hidden unless you switch it on under General.
Storage	Free (+ Pro panel)	Where uploaded files are stored. With Pro, the Google Drive connection panel appears here too.
Licence	Pro	Activating your Pro licence. This tab only exists when Pro is installed.
Advanced	Free	Whether data is erased when the plugin is uninstalled

Pro tabs are labelled (Pro) and placed next to the free tabs they relate to. The exact order can vary slightly depending on which Pro tabs are present. The Notification log is no longer a settings tab. It is its own menu item: Attestation Core → Notifications.

How settings are saved and stored

Each tab saves on its own. Every tab (and each form inside a tab) has its own save button, for example Save general settings or Save notification settings. Changes on other tabs aren’t saved at the same time. A green message confirms the save, and errors appear in red at the top of the tab.
Changes take effect immediately. Saving the currency recency threshold also refreshes the matrix straight away.
Settings are stored in your WordPress database: plugin options in the options table, and the Library (document types, evidence categories) in the plugin’s own tables. Most settings are loaded only when needed, not on every page.
Secrets are encrypted (Pro). The Google Drive client secret and tokens, Twilio credentials and webhook secrets are encrypted before saving. Your host can move the encryption key out of the database by defining ATTESTATION_CORE_PRO_SECRET_KEY in wp-config.php.
Uninstalling: credentials (Google Drive, SMS, licence) and the General tab settings are always removed when the plugin is deleted. Compliance data, the Library and other settings are kept unless Erase all data on uninstall is ticked on the Advanced tab. See Requirements and installation.

General

Setting (UI label)	What it does	Default	Allowed values
Industry	Chooses the vocabulary and default document types for your sector. Changing it doesn’t delete existing data.	Generic / Other	Generic / Other. With Pro: also the Australian RTO preset.
Organisation name (RTO name under the RTO preset)	Used in email subjects, exported reports and the “From” name on notifications	Blank (the WordPress site name is used)	Any text
Organisation code (RTO code)	Identifier used in exported report file names and audit document footers	Blank	Up to 10 characters
Admin contact email	Receives administrator notifications (evidence submitted, plan submitted, plan overdue, credential 2-year alerts) and the test email	Blank (the WordPress admin email is used)	A valid email address, or blank
Annual plan due date (Day, Month)	The date each year by which staff should submit their annual plan	28 February	Day 1–31 and a month. The day must exist in every year, so 31 April and 29 February are rejected.
Currency recency threshold (months)	How many months back evidence counts as “current”. Saving refreshes the matrix immediately.	12	1–60
Advanced: Show advanced label customisation tab	Shows the Labels tab in the tab strip	Off	On / Off
Plan declaration statement	Text shown above the declaration checkbox on the Sign & Attest form in the staff portal. Show shipped default reveals the built-in wording.	Blank (the shipped default is used)	Plain text. HTML is stripped.

The tab also shows a System status panel. Daily background task shows “Scheduled. Next run: …” or a warning that it isn’t scheduled. The Re-run the setup wizard link starts the onboarding wizard again. See Plugin settings and onboarding wizard.

Error messages: “Admin email must be a valid email address.” · “Plan due-date day must be valid for the selected month (e.g. not 31 April or 29 February).” · “Currency recency threshold must be between 1 and 60 months.”

🔒 Pro feature — requires the Pro plugin.

Branding (Pro)

Setting (UI label)	What it does	Default	Allowed values
Organisation Logo (RTO Logo)	Logo on staff-portal pages and Pro exports. Select logo opens the Media Library. Remove clears it.	None	An image from the Media Library (recommended up to 400×120 px)
Primary brand colour	Colour of portal buttons and links, and the accent colour in Pro exports	Portal: `#1d4ed8`. Exports: `#2271b1`.	A hex colour with at least 4.5:1 contrast against white

Details: Custom branding.

Library

The Library tab has three sub-tabs.

Document types

The compliance documents each person must keep, such as First Aid certificates. Requires the manage documents permission. Details: Document management.

Field	What it does	Default	Allowed values
Slug	Permanent internal identifier	— (required)	Lower-case letters, numbers, hyphens or underscores. Must be unique.
Name	Name shown to staff and in reports	— (required)	Text
Description	Optional help text	Blank	Text
Required for	Which workforce types must hold this document	All compliance profiles	All, or any combination of workforce types
Expiry type	How the document expires	No expiry	Fixed expiry date · Rolling annual review · No expiry
Alert lead times	Days before expiry to send reminders	`90,60,30,7`	Comma-separated whole numbers
Sort order	Position in lists	0	Whole number
Active	Whether the type appears in upload pickers	On	On / Off. Use Activate or Deactivate in the list.

The list also has a Save requirements button on each row, for changing which workforce types need that document.

Evidence categories

The categories staff choose from when submitting evidence. Requires the manage_options WordPress permission (administrators).

Field	What it does	Default	Allowed values
Name	Shown to staff in the evidence form	— (required)	Text
Slug	Identifier saved on each evidence record. It can’t be changed after creation.	— (required)	Lower-case letters, numbers and underscores. Must be unique.
Description	Optional explanation shown to staff	Blank	Text
Requires unit mapping	Evidence in this category must be linked to at least one unit	Off	On / Off
Display order	Position in the drop-down (lower numbers first)	0	0 or higher

Workforce types

The employment categories used to decide who needs which documents.

Field	What it does	Default	Allowed values
Custom label (built-in types)	Renames a built-in type: Employee (full-time / part-time), Contractor, Casual employee, Volunteer, Support staff, Administrative staff, Compliance staff, Leadership / manager	Blank (the industry preset label is used)	Text
Hidden (built-in types)	Removes the type from new-assignment drop-downs. Existing staff keep it.	Off	On / Off
Label (custom types)	Renames a custom type	Text you entered	Text
New type label	Adds a custom type. Its slug is generated automatically and is permanent.	Blank	Text
Delete (custom types)	Removes a custom type. Only possible when no active staff use it; otherwise the row shows In use. Built-in types can’t be deleted.	—	—

The Leadership / manager type is what makes someone eligible to be a Department Coordinator in Pro.

Portal pages

Setting (UI label)	What it does	Default	Allowed values
Compliance Portal (Dashboard)	Page holding `[attestation_core_dashboard]`	— Not set —	Any published page
My Profile	Page holding `[attestation_core_my_profile]`	— Not set —	Any published page
My Documents	Page holding `[attestation_core_my_documents]`	— Not set —	Any published page
Submit Evidence	Page holding `[attestation_core_submit_evidence]`	— Not set —	Any published page
Evidence History	Page holding `[attestation_core_my_evidence]`	— Not set —	Any published page

Unassigned rows show “Not configured — portal navigation links for this shortcode will be inactive.” Auto-create missing portal pages publishes a page, with its shortcode, for every row that has no page yet. Rows that are already set up are left alone. See Frontend staff portal.

🔒 Pro feature — requires the Pro plugin.

With an active Pro licence, four more rows appear: Annual Plan ([attestation_core_submit_plan]), My Compliance Record ([attestation_core_my_record]), My Compliance Calendar ([attestation_core_my_calendar]) and Upskilling Plan ([attestation_core_my_upskilling_plan]). All default to — Not set —.

Notifications

Setting (UI label)	What it does	Default	Allowed values
Send test email (button)	Sends “Attestation Core test email” to the admin contact email	—	—
Master switch: Send notification emails	Turns off all notification emails, whatever the individual settings	On	On / Off
Send? (one per notification)	Turns a single notification on or off	On	On / Off
Subject / Body (one per notification)	Your wording for that email. A blank field uses the shipped default (see Show shipped default). Reset to default clears your wording.	Blank (shipped default)	Plain text with `{{token}}` placeholders

The free plugin lists six notifications: Document expiring in 30 days, Document expired, Annual review document due, Evidence validated, Evidence returned for revision (all sent to the staff member) and Evidence submitted (admin alert) (sent to the admin contact email).

Supported tokens: {{rto_name}}, {{admin_email}}, {{site_url}}, {{trainer_name}}, {{reviewer_name}}, {{document_type}}, {{expiry_date}}, {{plan_year}}, {{due_date}}, {{plan_status}}, {{admin_comment}}, {{evidence_type}}, {{evidence_title}}, {{evidence_date}}, {{credential_name}}, {{start_date}}. Unknown tokens are replaced with nothing. See Automated email notifications.

🔒 Pro feature — requires the Pro plugin.

Pro adds more rows to this table, each with the same Send?, Subject and Body fields, all on by default. They include document expiring in 90, 60 and 7 days; annual plan due soon, overdue, submitted, approved and returned; credential working-towards 2-year limit; staff upskilling plan reminders; and, under the RTO preset, compliance milestone, validation panel and unit validation alerts. With a logo set on the Branding tab, the extra token {{rto_logo_url}} is also available.

🔒 Pro feature — requires the Pro plugin.

Escalations (Pro)

Escalations run once a day, after the standard expiry notifications, for documents that are still expired after a set number of days.

Setting (UI label)	What it does	Default	Allowed values
Enable escalations: Run escalation checks each day	Master switch	On	On / Off
Escalation recipients: Send to trainer supervisor (when assigned)	Emails the person’s supervisor	On	On / Off
Escalation recipients: Send to admin email	Emails the admin contact email	On	On / Off
Default threshold (days)	Days after expiry before escalating, for any document type without its own value	14	1–365
Escalate after (days), one per document type	Overrides the default for that type. A note shows when a type is using the default.	Default threshold	1–365

SMS (Pro)

Setting (UI label)	What it does	Default	Allowed values
Enable SMS: Send SMS notifications via Twilio	Master switch	Off	On / Off
Twilio Account SID	Your Twilio account ID. Stored encrypted and never shown again.	Blank	Text (starts with AC)
Twilio Auth Token	Your Twilio token. Stored encrypted and never shown again.	Blank	Text
From Number	Your Twilio sending number	Blank	E.164 format, e.g. `+61412345678` (only digits and `+` are kept)
Send SMS (one per notification type)	Which notifications are also sent by SMS. Staff only receive texts when a mobile number is on file.	All off	On / Off
Send test SMS: Send to	Sends a test text to a number you enter	—	E.164 number

Scheduled Reports (Pro)

Each schedule is a row with these fields. Reports are sent as PDF attachments by the WordPress scheduler, and times are in your site’s time zone.

Field (UI label)	What it does	Default	Allowed values
Report type	Which report to send	— Select report — (required)	Any report on your Reports screen
Frequency	How often it repeats	— (required)	Weekly · Monthly · Quarterly
Recipients	Who receives it	— (required)	One or more email addresses separated by commas, semicolons or new lines
First run date/time	The first send. Later runs continue from this point.	— (required)	Date and time
Active: Enable this schedule	Pauses or resumes the schedule	On	On / Off

Each schedule also has Send now and Delete buttons. The list shows the next and last run times. Details: Compliance reporting.

Webhooks (Pro)

Field (UI label)	What it does	Default	Allowed values
Endpoint URL	Where event data is sent, as JSON	— (required)	An HTTPS web address
Events	Which events are sent	None ticked	Evidence validated · Annual plan approved · Annual plan rejected · Credential verified · Document expiry alert sent
HMAC secret	Optional signing secret. Each delivery then carries an `X-Attestation-Core-Signature` header (HMAC-SHA256 over `{timestamp}.{raw_json_body}`). Leave it blank to keep the existing secret.	Blank	Text (stored encrypted)
Active: Enable immediate delivery	Pauses or resumes the endpoint	On	On / Off

Below the form are a list of Configured endpoints, with a Delete button for each, and a paged Delivery log showing time (UTC), event, endpoint, HTTP code and response, with a Retry button.

Labels

Hidden unless Show advanced label customisation tab is ticked on General. Each field overrides one word or phrase used throughout the plugin. A blank field uses your industry preset’s wording, which is shown as grey placeholder text, and a ✎ mark shows which terms you have changed. Click Save labels to save, or Reset to preset defaults to clear every override. This tab requires the manage_options WordPress permission.

Setting (UI label)	Generic default	Allowed values
Staff member (singular)	Staff Member	Text
Staff members (plural)	Staff	Text
Organisation type	Organisation	Text
Compliance plan (singular)	Compliance Plan	Text
Compliance plans (plural)	Compliance Plans	Text
Evidence	Evidence	Text
Unit (singular, inline body text)	Unit	Text
Units (plural, inline body text)	Units	Text
Unit heading (singular, menu titles and page headings)	Unit	Text
Unit heading (plural, menu titles and page headings)	Units	Text
Plan section 1 heading (first activities section)	Professional development	Text
Plan section 2 heading (second activities section)	Practical experience	Text

The Pro RTO preset supplies its own defaults, for example “Trainer/Assessor”, “RTO” and “Currency Plan”.

Storage

Setting (UI label)	What it does	Default	Allowed values
Active backend (read-only)	The backend new uploads are actually using: `private-media`, or `google-drive` with Pro	`private-media`	Read-only
Preferred backend	Where new uploads should go	Private media directory (default)	Private media directory

Private media directory. Files are kept in a private folder that isn’t served by the web server. By default this is one level above your WordPress folder. On hosts where that isn’t possible, the plugin uses wp-content/uploads/attestation-core-private/, locked down with deny rules and randomised file names. Files can only be opened through the plugin’s signed-in download links. Allowed types are PDF, JPG, PNG, DOC and DOCX, up to 25 MB (or your server’s upload limit, if lower).

Security self-test. Once a day, the plugin checks that the private folder can’t be reached from the web, and shows a red admin notice if it can. The tab gives the Nginx rule to add in that case.

🔒 Pro feature — requires the Pro plugin.

Google Drive (Pro) panel

Setting (UI label)	What it does	Default	Allowed values
Authorised redirect URI (read-only)	The address to register in Google Cloud Console	Your site’s callback address	Read-only
Client ID	Your Google OAuth client ID. Read-only if set in `wp-config.php` as `ATTESTATION_CORE_GDRIVE_CLIENT_ID`.	Blank	Text
Client secret	Your Google OAuth client secret (stored encrypted; leave blank to keep the saved value). Read-only if set as `ATTESTATION_CORE_GDRIVE_CLIENT_SECRET`.	Blank	Text
Drive folder ID	The destination folder for per-person subfolders	Blank (top level of the connected account’s Drive)	A Drive folder ID
Google Drive filename mode	How uploaded files are named in Drive	Anonymized (recommended)	Anonymized · Readable
Connection status	Connect Google Drive or Disconnect Google Drive	Not connected	—

In version 1.0.0, Google Drive isn’t yet offered in the Preferred backend list. Details and setup: Google Drive storage.

🔒 Pro feature — requires the Pro plugin.

Licence (Pro)

This tab only appears when the Pro plugin is installed. The free plugin has no licence settings.

Setting (UI label)	What it does	Default	Allowed values
Pro Licence Key	Paste the key from your purchase confirmation, then click Activate Licence	Blank	Your licence key
Status / Licence key / Plan / Expires (shown once active)	Confirms the licence is Active, with the key partly masked, your plan and its expiry date	—	Read-only
Deactivate Licence (button)	Releases the licence from this site so you can use it on another	—	—

If the licence expires or becomes invalid, Pro features keep working for a 7-day grace period. After that, Pro features switch off until the licence is reactivated, and the tab says “The grace period has ended — Pro features are currently disabled until the licence is activated.” The free plugin keeps working throughout.

Advanced

Setting (UI label)	What it does	Default	Allowed values
Erase all data on uninstall	When ticked, deleting the plugin permanently removes all compliance data (plans, evidence records, staff profiles, document types, notification logs and plugin settings). This can’t be undone.	Off (data kept)	On / Off

Click Save advanced settings to save.

Was this helpful?