The Private Credentials add-on for SupportCandy was developed to ensure the security of user credentials, because this plugin saves data in encrypted form. When certain sensitive information is displayed in a ticket, the same information is likely to be stolen and misused.
This is EXACTLY the same product as distributed by the developer. Sales Page
THIS ITEM IS ACTIVATED
Encrypted Storage: All credentials submitted through the widget are stored in the WordPress database using an encrypted format, ensuring data remains secure even if the database is accessed.
Dedicated Widget: A “Private Credentials” widget appears on the sidebar of individual ticket pages. This separates sensitive data from the general conversation thread.
Role-Based Access Control (RBAC): Administrators can define exactly which agent roles have the authority to:
View credentials.
Modify/Add credentials.
Delete credentials.
Dynamic Visibility: Permissions can be restricted based on ticket assignment (e.g., an agent might only see credentials for tickets assigned to them, not “Assigned to others”).
Customer Autonomy: The ticket creator (customer) can add, edit, or delete their credentials at any time during the support process.
Automatic Cleanup: Some versions allow for credentials to be automatically deleted once a ticket is closed to maintain a “zero-knowledge” security posture.
| Specification | Requirement/Detail |
| WordPress Compatibility | Version 4.0 or higher |
| SupportCandy Version | Requires SupportCandy Core (v2.5+ or v3.0+ depending on version) |
| PHP Version | PHP 7.0 or higher (PHP 8.x recommended) |
| Data Handling | AES-256 Encryption (standard for SupportCandy add-ons) |
| License Type | Premium Add-on (included in SupportCandy bundles) |
Normally, if a customer types a password into a ticket reply:
The password is sent via unencrypted email notifications to the agent.
The password is saved in plain text in the ticket thread.
Any agent with “View Ticket” access can see it.
The Private Credentials add-on bypasses all three risks by keeping the data out of the thread and restricting it to authorized eyes only.
