Menu

AI content provenance

Does WordPress preserve C2PA Content Credentials?

Direct answer

Do not assume WordPress preserves C2PA across generated image sizes. WordPress documents that resized images strip metadata by default; its image_strip_meta filter applies to Imagick, while GD always strips profiles. The original upload and each thumbnail, responsive size, converted format, CDN rendition and cached copy must be tested separately. Keeping metadata does not guarantee a valid credential after re-encoding.

Applies when

  • Use this evidence when you need to verify per-URL verification can establish whether the exact served rendition carries a valid credential.
  • Use this evidence when you need to verify a controlled test can locate the WordPress or delivery step that changes the result.

Doesn't apply when

  • Do not treat this evidence as proof that every theme breakpoint or future regenerated size behaves identically.
  • Do not treat this evidence as proof that preserved EXIF or XMP alone is a complete, valid C2PA manifest.

Worked decision

Example

The full-size JPEG verifies, but the 1200-pixel WordPress derivative and CDN WebP return no credential.

Interpretation

The public page lacks machine-readable provenance even though the Media Library master retains it. Choose a tested rendition strategy, monitor regenerated variants and show plain-language disclosure on the page.

Next steps

Required action

  1. Upload a known credentialled test asset and verify the stored original before changing configuration.
  2. Enumerate the exact URLs used in src and srcset, plus CDN or optimizer renditions, and download each for verification.
  3. Configure a provenance-preserving path only after testing the chosen image editor and formats; retain the original and visible disclosure regardless.

Publishing layer

Platform differences

WordPress original

The original upload may preserve its credential while the public page serves a different generated image.

Responsive and CDN variants

Thumbnails, srcset files, format conversions, optimizers and CDN renditions must each be verified separately.

Social destinations

A later platform upload can transform the asset again and apply its own label policy independently.

Evidence

Source

Freshness and accountability

Last verified

Last reviewed 2026-09-12 · Current

Run this exact scenario

A representative asset scenario is prefilled. Confirm how provenance was created, whether it survived the final export and where the asset will be published.

Open prefilled checker

How to read the signal

Key facts

Original uploadThe master file may remain stored, but the page can serve a generated derivative instead.
ImagickWordPress exposes image_strip_meta; the default is to strip metadata during resizing.
GDThe WordPress developer reference states that GD always strips profiles, so the Imagick filter does not solve that path.
Responsive deliverysrcset, WebP or AVIF conversion, optimization plugins and CDNs can produce different bytes from the verified master.

Quality gate

Common failure modes

  • Verifying only the Media Library original while visitors receive a stripped thumbnail.
  • Setting image_strip_meta to false and assuming a pixel-changing resize remains cryptographically valid.
  • Letting an optimization plugin or CDN silently replace a tested image with an untested rendition.

Disclara treats technical provenance as evidence about process, not as proof of truth, authorship or legal compliance. This page is source-backed information, not legal advice. Review the sources and methodology.