Provenance
Content Credentials on shared images: what survives a share
Quick answer
Content Credentials are signed provenance records, defined by the C2PA standard, that travel inside an image file and describe how it was made and edited. They survive only while the file is left alone: resizing, recompression and most social uploads remove or invalidate them. Point your og:image at a file that still carries its credentials, and expect some networks to strip them anyway.
On this page
What a Content Credential is
The Coalition for Content Provenance and Authenticity (C2PA) publishes an open standard for attaching a manifest to a media file. The manifest records assertions such as which device or application created the file, which edits were made, and whether a generative tool was involved. It is cryptographically signed, and it includes a hash of the image data, so any change to the pixels breaks the link between the record and the file.
Content Credentials is the public name for these manifests. Some cameras sign photographs at capture, many editing applications add a manifest on export, and most large image generators now attach one to their output. A viewer that understands the standard can show a small badge and let readers inspect the history.
Why credentials disappear on WordPress
When you upload an image, WordPress keeps the original and generates smaller copies for thumbnails, content widths and often the share image. According to the WordPress developer reference, the GD editor strips metadata from those copies, and the Imagick editor strips everything except a short list of colour, copyright, orientation and rights profiles. The C2PA manifest is not on that list, and even if it were, resizing changes the pixels, so the signed hash would no longer match.
Image optimisation plugins and CDNs that convert to modern formats have the same effect. The result is common: the original upload carries credentials, and every file your pages actually show, including the one named in og:image, carries none. The guide to choosing an Open Graph image size explains which copy most themes put in the preview.
Keeping credentials on the image you share
Export the share image deliberately
Produce the 1200 by 630 share image in a tool that writes a new manifest on export, listing the original as an ingredient. The crop then has valid credentials of its own.
Upload it without resizing
Upload the file at exactly the size you will use, and point og:image at the original upload rather than a generated sub-size. Check the address in the page source.
Exclude it from optimisation
Tell your image optimisation or format conversion plugin to skip that file, or serve it from a path the optimiser ignores.
Verify the published file
Download the image from its public address and inspect it with a C2PA verification tool. If the manifest is missing, something in your stack is still rewriting it.
What networks do with the file
Once a network fetches your share image, its own pipeline takes over. Many platforms recompress uploads and link-preview images, which removes embedded manifests. Some read the metadata before they discard it and use it to decide on labels; others preserve it or show a credentials badge. Behaviour differs by network and changes over time, so treat any single test as a snapshot, not a rule.
The IPTC photo metadata standard offers a simpler companion signal: a digital source type field whose values distinguish, for example, a camera original from an image made by a trained algorithm. Some platforms read this field as well as, or instead of, a full manifest.
Honest limits
Content Credentials prove what a signer asserted about a file, not that the content is true. A missing credential proves nothing either way, because most legitimate images on the web have none. For publishers the value is accountability: when your newsroom or your illustrator signs an image, anyone can check where it came from. The companion guide on AI labelling policies across platforms covers how that data feeds into labels.
More on this topic sits in the provenance and authorship section: start with AI-generated content in social feeds: what publishers should do, then authorship tags for shared links: author, article:author and fediverse:creator.
Questions
Does WordPress keep Content Credentials?
It keeps them on the original upload but removes them from resized copies, which are usually the files your pages and previews use.
Can I add Content Credentials to an existing image?
Yes, with a tool that signs a new manifest. It records you as the signer from that point; it cannot vouch for the image's earlier history.
Do Content Credentials show up on Facebook or X previews?
Generally not as a visible badge today. Some platforms read the data to decide on labels, then strip it from the copy they display.
Hannah Voss, Editor. Checks every guide against a working WordPress install and the networks' current documentation. Last reviewed September 2026.
Related reading
- How platforms label AI content, and what triggers the labelHow major platforms decide to label AI-generated or altered media: creator disclosure, provenance metadata, detection, and how publishers avoid mistakes.4 min read
- Open Graph image size: 1200 by 630 and the safe zoneThe right Open Graph image size is 1200 by 630 pixels at a 1.91:1 ratio. Minimums, file limits, formats, and a centre safe zone for square crops.3 min read
- AI-generated content in social feeds: what publishers should doHow AI-generated images and text change what happens when your posts are shared, and the practical steps publishers can take: disclosure, provenance, bylines.4 min read
- Facebook showing the wrong image or share textFix Facebook showing the wrong image or text when you share a WordPress post: duplicate tags, small images, cache, blocked crawlers, and the Sharing Debugger.3 min read