XYZ Age Verification provides real age verification for WordPress sites that need to comply with age-gating regulations. Unlike simple “click to confirm” plugins, XYZ uses biometric liveness detection and optional government ID verification to confirm that a visitor is not a minor.
How it works:
- Visitors from configured regions are redirected to an age gate page.
- They complete a face liveness check (Tier 1) or liveness + government ID verification (Tier 2).
- Upon verification, a secure cookie is set and the visitor is granted access.
- All biometric data is processed in real-time and is not stored.
Key features:
- Two-tier verification: face liveness check or liveness + government ID
- Region-specific rules with Cloudflare geo detection
- Configurable minimum age per region (Tier 2 auto-enforced for non-18 thresholds)
- QR code for mobile phone verification
- Popup or same-device verification options
- Real-time session status polling
- Configurable bypass cookies for pre-verified users
- Configurable fail-open or fail-closed behavior for API outages and credit exhaustion
- Cryptographically signed verification cookies (HMAC-SHA256)
- Server-side API key handling (never exposed to the browser)
- Logged-in WordPress users automatically bypass the age gate
- Built-in free plan admin: manage regions, thresholds, and view verification history
- Setup checklist and API health check on the settings page
- Admin notices for common misconfigurations
- Contextual help tabs with setup guide and troubleshooting
- Compatible with standard WordPress page caches (not compatible with WP Rocket — see FAQ)
- Privacy-focused: no biometric data stored
Free plan included:
This plugin includes a free plan with 100 verification credits per month — no credit card required. Register directly from the plugin settings page with just your email address. Credits reset monthly and do not roll over. Additional credit packs are available for sites that need more capacity.
Requirements:
- An XYZ Age Verification API key (register for a free plan directly from the plugin settings, or sign up at xyzinc.com)
- Cloudflare proxying — free plan or higher (required for geo detection headers
CF-IPCountryandCF-Region-Code) - HTTPS enabled
External service — XYZ Age Verification API:
This plugin connects to the XYZ Age Verification API at https://age-verify.xyzinc.com, operated by XY Zinc (a brand of Chaos Unlimited LLC), to perform biometric liveness detection and government ID document verification. The plugin cannot function without this service — it is the core verification engine.
When a visitor triggers age verification, the plugin sends the visitor’s country and state codes (derived from Cloudflare headers) to the API to create a verification session. The visitor then interacts directly with the verification UI hosted by the service. No biometric data passes through your WordPress server. The plugin polls the API for session status and receives only a pass/fail result.
Planned Features
The following enhancements are planned for future releases:
Restricted path mode (Pro)
Currently the age gate applies to your entire site based on visitor region. A future release of the Pro plugin will add a restricted paths mode, allowing site owners to age-gate only specific URL paths (e.g., /mature/, /adult-content/) while leaving the rest of the site accessible without verification. This is ideal for sites that contain a mix of general and age-restricted content — such as sexuality education sites, media outlets with adult sections, or e-commerce stores with age-restricted product categories.
Additional credit packs
Credit packs are available for purchase via PayPal for sites that need more capacity. Purchased credits are added to a prepaid balance that persists until used — they do not expire or reset monthly. Multiple packs can be stacked.
Third-Party Libraries
This plugin includes the following third-party library:
- QRCode.js — Client-side QR code generation
- Source: https://github.com/davidshimjs/qrcodejs
- License: MIT
- Files:
assets/js/qrcode.js(unminified source),assets/js/qrcode.min.js(minified)
No build tools are required. The library is included as-is from the upstream repository with a minor CSS modification (image display style changed from “block” to “inline-block” for QR code placement). The unminified source is included in the plugin for review.
