SupportCandy Private Credentials Addon
Antivirus scan
Powered by ClamAV
✅ Verified clean
This product file has passed our security filters.
Want to run a fresh ClamAV scan right now? Takes a few seconds and shows scanner version, signature DB and live result.
This can take 5 to 30 seconds.
Clean file Threat detected
No threats detected in this file.
- File
- Size
- Scanned
- ClamAV
- Signature database
⚡ Powered by ClamAV
Scan could not be completed
Report product
If you detected an issue (broken file, malware, inappropriate content, etc.) let us know and we'll review it ASAP.
Sign in to report
About SupportCandy Private Credentials Addon
Passwords that stay in the ticket thread
When a customer needs you to get into their hosting, their admin panel or their FTP, the most natural thing is to paste the details into a ticket reply. It is convenient, but that message stays in the history, travels in email notifications and can be read by any agent with read permission on that ticket.
For a web development agency or freelancer, the problem is not only the moment of sending. The password is still there months later, in email inboxes and in closed tickets nobody reviews, and every new team member with access to the ticket sees it without anyone having decided that. SupportCandy Private Credentials Addon exists to take those details out of the conversation thread.
A dedicated widget inside every ticket
The addon adds a widget called Private Credentials to the individual ticket page. It works like this:
- The customer (the ticket creator) can add, edit and delete their credentials in that widget.
- The information is stored encrypted in the database.
- Agents with the right capability can view, add, modify or delete them.
What helps is the separation: the conversation stays a conversation and the access details live somewhere else. If the customer changes a password, they edit the entry in the widget instead of sending another reply with the new version.
Permissions by agent and by ticket type
Three capabilities are added to the agent role:
- View Credentials: read permission for the credentials.
- Modify Credentials: permission to add and edit.
- Delete Credentials: permission to delete.
Each one can be applied depending on how the ticket is assigned: unassigned, assigned to the agent themselves, or assigned to others (agents or groups). That way each technician can see the access details only for the tickets they handle, and whoever sorts unassigned tickets does not see them. Think this policy through before handing out permissions: if you give them to everyone, you are back where you started.
Installing it or keeping to another channel for access details
It is an add-on: it needs SupportCandy and does not work on its own. It also does not protect you from a customer who, out of habit, pastes the password into a normal reply. It is worth telling your customers to use the widget and not the message body. If your support does not handle access to third-party sites, you probably do not need it.
Who can see the credentials?
The customer who created the ticket and the agents with the View Credentials capability, within the ticket types (unassigned, their own or others) you have configured.
Are they sent by email?
The email risk appears when the details are written in a reply. The widget is designed precisely to avoid that route.
Can the customer delete them when the work is done?
Yes, the ticket creator can add, edit and delete their credentials in the widget.
Does it work without SupportCandy?
No. It is an addon installed on top of SupportCandy that adds the widget to its tickets.
Topics
Version history
-
v
3.1.3 Current 30 Sep 2026
-
v
3.1.2 25 Mar 2026
Customer reviews
Sign in to leave a review. Only people who have the product can review it.
No reviews for this product yet.
Frequently asked questions
-
GPL (General Public License) is the license under which WordPress and most premium plugins/themes are distributed. It grants you the right to use, modify and redistribute the software in as many projects as you want, with no domain restrictions.
-
Yes. With membership you get automatic updates via our GPLClub Updater plugin (installed on your WP, detects new versions and applies them). With individual purchase, you get one year of manual updates from your account.
-
Depends on the plan. Monthly: 3 domains. Semi-annual: 7. Annual and Lifetime: 15. Individual purchase: 1 domain.
-
GPLClub offers its own support for installation, configuration and compatibility. For direct support from the original author (feature requests, product-specific bugs), a license purchased from the author is required.
