SupportCandy Private Credentials

SupportCandy Private Credentials is an add-on for handling sensitive details connected with support work. It is aimed at cases where a customer needs to share website access, FTP details, user credentials, passwords, or API keys, but sending those values as ordinary plain text would expose them to unnecessary risk.

Credential handling

The central idea is to give private information its own management layer rather than treating it as another line in a ticket conversation. The vendor describes secure storage for credentials and support for several credential types, including passwords and API keys. That makes the add-on relevant to support teams and site developers who regularly need access details to investigate or maintain a customer’s site.

This is a focused solution rather than a general-purpose content feature. Its value comes from keeping credential-related work tied to the support process while separating sensitive values from the ordinary exchange of ticket messages. The product description does not explain the underlying storage or protection method, so the security benefit should be judged by the controls available in the installed product, not by the word “private” alone.

Access with boundaries

Customisable access controls are one of the more useful parts of the feature list. Administrators can determine who is allowed to view or edit credentials, which gives a support operation more control than simply allowing every participant in a ticket to see the same information. The stated integration with existing WordPress user accounts also keeps account management within the site’s established user structure.

The distinction between viewing and editing matters in practice. A technician might need to read a password without changing it, while a manager or account owner may need to correct an old API key. The listing specifically mentions both permissions, although it does not provide a detailed breakdown of roles, rules, or permission conditions.

Records of change

Built-in user activity logs add an audit trail around credential access and changes. That gives administrators a way to monitor who interacted with stored information and when changes were made, rather than relying entirely on memory or ticket replies. For teams sharing responsibility for several customer sites, this record can make handovers and follow-up questions easier to investigate.

The interface is described as responsive, so the credential screens are intended to remain usable across different device sizes. The vendor also states that the add-on receives regular updates for security and compatibility with current WordPress versions. Those are useful maintenance commitments, but the listing does not specify the update schedule or the details of the compatibility process.

What to weigh

The first reservation is that the available description says little about the technical security model. It does not identify encryption at rest, encryption in transit, key management, masking rules, or recovery procedures. Those omissions matter more here than they would for an ordinary ticket customisation because a compromised account could expose credentials with consequences outside WordPress.

The second trade-off is administrative overhead. Access rules and activity logs provide control, but they also require someone to review permissions, remove access when responsibilities change, and respond to suspicious activity. The add-on also appears narrowly focused on credentials within the SupportCandy workflow; organisations seeking a dedicated secrets vault, broad application integrations, or detailed security governance will need to assess whether this scope is sufficient.

Who it suits

SupportCandy Private Credentials is best suited to WordPress-based support desks that routinely request access details from customers and want a more structured alternative to plain-text ticket messages. Its combination of credential types, account-linked access controls, and activity logging covers the basic workflow described by the vendor.

It is less compelling as a standalone credential-management system because the published feature list does not describe broader vault functions or technical safeguards in depth. For a SupportCandy team with a clear need to manage passwords and API keys inside its support operation, the focused feature set is easy to understand. The purchasing decision should rest on confirming the security implementation and permission model before sensitive production credentials are entrusted to it.