Content Credentials on shared images: what survives a share

What a Content Credential is

The Coalition for Content Provenance and Authenticity (C2PA) publishes an open standard for attaching a manifest to a media file. The manifest records assertions such as which device or application created the file, which edits were made, and whether a generative tool was involved. It is cryptographically signed, and it includes a hash of the image data, so any change to the pixels breaks the link between the record and the file.

Content Credentials is the public name for these manifests. Some cameras sign photographs at capture, many editing applications add a manifest on export, and most large image generators now attach one to their output. A viewer that understands the standard can show a small badge and let readers inspect the history.

Why credentials disappear on WordPress

When you upload an image, WordPress keeps the original and generates smaller copies for thumbnails, content widths and often the share image. According to the WordPress developer reference, the GD editor strips metadata from those copies, and the Imagick editor strips everything except a short list of colour, copyright, orientation and rights profiles. The C2PA manifest is not on that list, and even if it were, resizing changes the pixels, so the signed hash would no longer match.

Image optimisation plugins and CDNs that convert to modern formats have the same effect. The result is common: the original upload carries credentials, and every file your pages actually show, including the one named in og:image, carries none. The guide to choosing an Open Graph image size explains which copy most themes put in the preview.

Keeping credentials on the image you share

1. 01

   Export the share image deliberately

   Produce the 1200 by 630 share image in a tool that writes a new manifest on export, listing the original as an ingredient. The crop then has valid credentials of its own.

2. 02

   Upload it without resizing

   Upload the file at exactly the size you will use, and point og:image at the original upload rather than a generated sub-size. Check the address in the page source.

3. 03

   Exclude it from optimisation

   Tell your image optimisation or format conversion plugin to skip that file, or serve it from a path the optimiser ignores.

4. 04

   Verify the published file

   Download the image from its public address and inspect it with a C2PA verification tool. If the manifest is missing, something in your stack is still rewriting it.

What networks do with the file

Once a network fetches your share image, its own pipeline takes over. Many platforms recompress uploads and link-preview images, which removes embedded manifests. Some read the metadata before they discard it and use it to decide on labels; others preserve it or show a credentials badge. Behaviour differs by network and changes over time, so treat any single test as a snapshot, not a rule.

The IPTC photo metadata standard offers a simpler companion signal: a digital source type field whose values distinguish, for example, a camera original from an image made by a trained algorithm. Some platforms read this field as well as, or instead of, a full manifest.

Honest limits

Content Credentials prove what a signer asserted about a file, not that the content is true. A missing credential proves nothing either way, because most legitimate images on the web have none. For publishers the value is accountability: when your newsroom or your illustrator signs an image, anyone can check where it came from. The companion guide on AI labelling policies across platforms covers how that data feeds into labels.

Content Credentials (C2PA): a worked example

Suppose a newsroom exports a 1200 by 630 share image with a fresh manifest, uploads it to WordPress and shares the post on four networks. The numbers below are invented for this example. Downloading each copy and opening it in a C2PA reader gives the result in the table: the original upload validates, every resized copy has no manifest at all, the optimiser's WebP copy has none, and each of the four preview images fetched back from the networks has none either.

In this example the only file that ever carries a valid credential is the one you uploaded, and it reaches a reader only if og:image points at it and the optimiser leaves it alone. That is the whole practical task. The companion guide on what platforms strip from shared images covers the network side in more detail.

Pitfalls

• Pointing og:image at the original but letting a CDN rewrite it on the fly. The address is the same, the bytes are different, and the manifest is gone.
• Adding a manifest to the crop without listing the original as an ingredient. The crop then has a history that starts at the crop, which is honest but less useful.
• Regenerating thumbnails after a theme change. Every regeneration re-encodes the sub-sizes, so any manifest a plugin had preserved is lost again.
• Reading a valid manifest as proof of truth. It records what a signer asserted about the file's history and nothing about the scene.
• Testing with a cached card. Networks keep a preview for days; a card fetched before your change shows the old file.

Check it worked

After publishing, fetch the exact address in og:image with a command line client or a private browser window, save the bytes, and open the saved file in a C2PA reader. Then run the page through each network's sharing debugger, download the image the debugger shows, and inspect that too. Record both results in a share test log; the entries below are examples.

If the first row fails, fix your own stack before testing networks; the guide to where WordPress and CDNs strip metadata lists the usual culprits. If only the network rows fail, keep the credential on the page, as a caption and a link to the original file, and stop expecting the card to carry it. The rest of the provenance section covers those page-level signals.

Sources

• C2PA, the Coalition for Content Provenance and Authenticity
• WordPress developer reference: the image_strip_meta filter
• IPTC NewsCodes: digital source type vocabulary

Questions

Related reading

1. 01How platforms label AI content, and what triggers the labelHow major platforms decide to label AI-generated or altered media: creator disclosure, provenance metadata, detection, and how publishers avoid mistakes.6 min read
2. 02Open Graph image size: 1200 by 630 and the safe zoneThe right Open Graph image size is 1200 by 630 pixels at a 1.91:1 ratio. Minimums, file limits, formats, and a centre safe zone for square crops.6 min read
3. 03AI-generated content in social feeds: what publishers should doHow AI-generated images and text change what happens when your posts are shared, and the practical steps publishers can take: disclosure, provenance, bylines.7 min read
4. 04Facebook showing the wrong image or share textFix Facebook showing the wrong image or text when you share a WordPress post: duplicate tags, small images, cache, blocked crawlers, and the Sharing Debugger.7 min read