XYZ Age Verification provides real age verification for WordPress sites that need to comply with age-gating regulations. Unlike simple “click to confirm” plugins, XYZ uses biometric liveness detection and optional government ID verification to confirm that a visitor is not a minor.

How it works:

Visitors from configured regions are redirected to an age gate page.
They complete a face liveness check (Tier 1) or liveness + government ID verification (Tier 2).
Upon verification, a secure cookie is set and the visitor is granted access.
All biometric data is processed in real-time and is not stored.

Key features:

Two-tier verification: face liveness check or liveness + government ID
Region-specific rules with Cloudflare geo detection
Configurable minimum age per region (Tier 2 auto-enforced for non-18 thresholds)
QR code for mobile phone verification
Popup or same-device verification options
Real-time session status polling
Configurable bypass cookies for pre-verified users
Configurable fail-open or fail-closed behavior for API outages and credit exhaustion
Cryptographically signed verification cookies (HMAC-SHA256)
Server-side API key handling (never exposed to the browser)
Logged-in WordPress users automatically bypass the age gate
Built-in free plan admin: manage regions, thresholds, and view verification history
Setup checklist and API health check on the settings page
Admin notices for common misconfigurations
Contextual help tabs with setup guide and troubleshooting
Compatible with standard WordPress page caches (not compatible with WP Rocket — see FAQ)
Privacy-focused: no biometric data stored

Free plan included:

This plugin includes a free plan with 100 verification credits per month — no credit card required. Register directly from the plugin settings page with just your email address. Credits reset monthly and do not roll over. Additional credit packs are available for sites that need more capacity.

Requirements:

An XYZ Age Verification API key (register for a free plan directly from the plugin settings, or sign up at xyzinc.com)
Cloudflare proxying — free plan or higher (required for geo detection headers CF-IPCountry and CF-Region-Code)
HTTPS enabled

External service — XYZ Age Verification API:

This plugin connects to the XYZ Age Verification API at https://age-verify.xyzinc.com, operated by XY Zinc (a brand of Chaos Unlimited LLC), to perform biometric liveness detection and government ID document verification. The plugin cannot function without this service — it is the core verification engine.

When a visitor triggers age verification, the plugin sends the visitor’s country and state codes (derived from Cloudflare headers) to the API to create a verification session. The visitor then interacts directly with the verification UI hosted by the service. No biometric data passes through your WordPress server. The plugin polls the API for session status and receives only a pass/fail result.

Planned Features

The following enhancements are planned for future releases:

Restricted path mode (Pro)

Currently the age gate applies to your entire site based on visitor region. A future release of the Pro plugin will add a restricted paths mode, allowing site owners to age-gate only specific URL paths (e.g., /mature/, /adult-content/) while leaving the rest of the site accessible without verification. This is ideal for sites that contain a mix of general and age-restricted content — such as sexuality education sites, media outlets with adult sections, or e-commerce stores with age-restricted product categories.

Additional credit packs

Credit packs will be available for purchase via PayPal for sites that need more capacity. Purchased credits will be added to a prepaid balance that persists until used — they will not expire or reset monthly. Multiple packs can be stacked.

Media file protection

We are investigating methods to extend age gate protection to files served from /wp-content/uploads/. Because media files are served directly by the web server and do not pass through WordPress PHP execution, this requires server-level solutions (e.g., Nginx/Apache rewrite rules, signed URLs, or a PHP-based file proxy). A future release will provide guidance and/or built-in support for common hosting configurations.

Third-Party Libraries

This plugin includes the following third-party library:

QRCode.js — Client-side QR code generation
- Source: https://github.com/davidshimjs/qrcodejs
- License: MIT
- Files: assets/js/qrcode.js (unminified source), assets/js/qrcode.min.js (minified)

No build tools are required. The library is included as-is from the upstream repository with a minor CSS modification (image display style changed from “block” to “inline-block” for QR code placement). The unminified source is included in the plugin for review.