Badges? Badgr Badges? We don’t need no stinking Badgr

As Middlebury closes the MIIS campus, we are also closing our non-credit online offerings.¹

The courses were in Canvas and they used Badgr/Parchment to award badges.² Of course Instructure ended up changing the rules around using Badgr/Parchment half way through and so, absent money, it stopped working. Pro-tip folks, don’t use any freemium stuff for anything that matters. That includes WP plugins/themes. It’s honestly worse than purely free abandoned stuff. Just don’t do it.

So now the courses are shutting down and people were promised badges. I wasn’t really happy with just sending them images (and that was before I understood the meta-data baked into actual badge images).

I had considered building a WP plugin to do badges when this whole thing started, but we went the Badgr route. I had some basic research and knowledge in the scrambled eggs that I call brains. It all seemed pretty straight forward . . . just returning some structured JSON at an endpoint with a dib and dab of badge/award connections. At the same time, no one wanted me investing time in building something like this for a program that had actually closed on July 1.

And, while it pains me to say this (and I know that it will likely result in at least one resident of Moose Jaw burning me in effigy) it’s the kind of thing I can knock out with Claude AI in 10 minutes verse at least an hour or two working in my traditional way.

So, I did.

It’s a plugin up on GitHub. Nothing fancy and almost no work put in on the human side other than making sure it validates. I don’t really consider it something I made, but it solves a problem so I can move on.³

The plugin lets you create badges which gives you the top-level details and then create an award which lets you assign people details to specific badge. It returns a JSON URL and a LinkedIn provisioning URL, and a “baked” PNG image with the right metadata added.

I’d suggest some polishing (and evaluation) if you were going to use this for real, but it does what I need.

One thing that hung me up initially was that the WP site was on MiddCreate (our Domain of One’s Own cPanel stuff) and I couldn’t get the badges to validate. It took me a bit to chase down that this was because of a top-level WHM setting that wouldn’t let outside forces fetch the data at all. This kind of thing prevents AI bot harvesting and other crap that we do want to prevent, but I needed to allow this.

I was able to go into WHM and to ModSecurity Tools and change the rule a bit to let the Python-driven badge validator do what it needed to do– access to our new badges endpoint and the hosted image we create when the badge gets created. You can see both those allowed paths in the second rule.

The original rule was this.

SecRule REQUEST_HEADERS:User-Agent "@rx (Bytedance|Bytespider|AhrefsBot|Amazonbot|python-requests|python-httpx)" "msg:'Annoying Bot Denied',phase:1,log,id:100001,t:none,drop"

The new rule is this.

SecRule REQUEST_HEADERS:User-Agent "@rx (Bytedance|Bytespider|AhrefsBot|Amazonbot|python-requests|python-httpx)" "chain,msg:'Annoying Bot Denied',phase:1,log,id:100001,t:none,drop"
SecRule REQUEST_URI "!@rx ^/badges/(wp-json/dlinq-badges/|wp-content/uploads/)"

It may be a bit too permissive, but I know where it is if I see issues down the road around bots slamming the site. Cut me a bit of slack. I’ve never even opened this tool before.