Title: XYZ Age Verification Author: xyzageverify Published: 13 março, 2026 Last modified: 3 junho, 2026 --- Pesquisar plugins ![](https://ps.w.org/xyz-age-verification-free/assets/banner-772x250.png?rev=3482278) ![](https://ps.w.org/xyz-age-verification-free/assets/icon-256x256.png?rev=3482278) # XYZ Age Verification Por [xyzageverify](https://profiles.wordpress.org/xyzageverify/) [Baixar](https://downloads.wordpress.org/plugin/xyz-age-verification-free.2.6.0.zip) * [Detalhes](https://br.wordpress.org/plugins/xyz-age-verification-free/#description) * [Avaliações](https://br.wordpress.org/plugins/xyz-age-verification-free/#reviews) * [Instalação](https://br.wordpress.org/plugins/xyz-age-verification-free/#installation) * [Desenvolvimento](https://br.wordpress.org/plugins/xyz-age-verification-free/#developers) [Suporte](https://wordpress.org/support/plugin/xyz-age-verification-free/) ## Descrição Most WordPress age verification plugins are age **gates** — a popup that asks visitors to click “Yes, I’m 18+” or pick a birthday from a dropdown. Anyone, including a minor, can click through in under a second. That used to be the standard. It is no longer a defensible compliance measure under the UK Online Safety Act, US state age verification laws (Texas, Louisiana, Virginia, and a growing list), or EU age assurance requirements under the Digital Services Act. XYZ Age Verification is different. It confirms visitors are adults using a real- time selfie liveness check, with automatic escalation to government ID verification for borderline cases or stricter age thresholds. **No biometric data is stored.** No checkbox to lie to. No date-of-birth dropdown that a child can spin in five seconds. **When you need this plugin:** * UK sites subject to the Online Safety Act and OFCOM enforcement * US sites subject to state-level age verification laws (Texas, Louisiana, Virginia, Utah, and a growing list) * EU sites subject to age assurance requirements under the Digital Services Act * Adult content, cannabis, alcohol, tobacco, firearms, and gambling sites where a click-through popup is no longer sufficient * Any site where “the visitor clicked Yes” is insufficient evidence that your audience is adult-only **Important — Cloudflare is required:** This plugin **requires that your site is proxied through Cloudflare’s network**. This is not an optional integration. Without Cloudflare, the plugin cannot determine where visitors are connecting from, and it will not work. Setting up Cloudflare involves changing your domain’s DNS settings to point at Cloudflare’s nameservers. This is a real infrastructure change with real consequences: * **Your email may stop working** if you don’t carefully preserve your existing MX, SPF, DKIM, and DMARC records during the migration. * **Other services that depend on DNS** (subdomains, third-party integrations, SSL certificates) may need attention. * **Reverting the change** takes 24-48 hours for DNS propagation, so mistakes are not immediately undoable. If you do not have experience with DNS migration, or if your site’s email and DNS are managed by someone else, please read these guides before installing the plugin: * [Why XYZ Age Verification requires Cloudflare](https://support.xyzinc.com/blog/18-why-the-xyz-age-verification-plugin-requires-cloudflare)— explains what the plugin needs from Cloudflare and why no alternative works * [Cloudflare setup guide](https://support.xyzinc.com/blog/2-2-cloudflare-setup)— step-by-step migration, with email preservation as the explicit focus **This plugin is not a fit for site owners who are not prepared to manage their own DNS.** If your site is hosted on a fully-managed platform where DNS is controlled by the host, or if the prospect of changing nameservers is unfamiliar, consider hiring help for the Cloudflare migration before installing. Alternatively, simpler self-declaration age gate plugins may better match your operational comfort level— they are not real verification, but they also do not require infrastructure changes. **Why XYZ Age Verification:** * **Real verification, not self-declaration** — Biometric liveness detection (iBeta Level 2 certified) plus optional government ID verification * **Privacy by design** — Biometric data is processed in real time and discarded immediately. Nothing is stored. No central database of faces or IDs * **Smart escalation** — Most adult visitors complete verification with a quick selfie. Only borderline cases are asked for ID, minimizing friction * **Region-specific rules** — Apply verification only where you need it, using Cloudflare’s geo detection. Configure different thresholds per country or US state * **Free plan included** — 100 verifications per month, no credit card required. Sign up directly from the plugin settings page * **Cryptographically signed cookies** — Visitors can’t bypass the gate with browser dev tools **Free plan included:** This plugin includes a free plan with 100 verification credits per month — no credit card required. Register directly from the plugin settings page with just your email. Credits reset monthly. Additional credit packs are available via PayPal for sites that need more capacity; your first purchase includes 300 bonus credits and switches your site to prepaid billing (credits do not expire or reset monthly). **How it works:** 1. Visitors from configured regions are redirected to an age verification page. 2. They complete a face liveness check (Tier 1) or liveness plus government ID verification( Tier 2). Tier 1 produces a binary adult/not-adult result — it does not estimate age. 3. If the liveness check indicates the visitor may be a minor, the system automatically escalates to government ID verification. For age thresholds other than 18 (e.g., 21+ for alcohol or cannabis), Tier 2 is required because only an ID document provides a verifiable date of birth. 4. Upon a successful verification, a cryptographically signed cookie is set and the visitor is granted access. 5. All biometric data, selfies, and document images are discarded immediately after the verification completes — regardless of the result. **Requirements:** * An XYZ Age Verification API key (register for a free plan directly from the plugin settings, or sign up at [xyzinc.com](https://www.xyzinc.com/wordpress-plugin)) * **Cloudflare proxying** — your domain’s DNS must be managed through Cloudflare’s network. A free Cloudflare plan provides everything the plugin needs (the geo detection headers `CF-IPCountry` and `CF-Region-Code`). See the “Cloudflare is required” section above for the implications of changing your DNS. * HTTPS enabled **External service — XYZ Age Verification API:** This plugin connects to the XYZ Age Verification API at `https://age-verify.xyzinc. com`, operated by XY Zinc (a brand of Chaos Unlimited LLC), to perform biometric liveness detection and government ID document verification. The plugin cannot function without this service — it is the core verification engine. When a visitor triggers verification, the plugin sends the visitor’s country and state codes (derived from Cloudflare headers) to the API to create a verification session. The visitor then interacts directly with the verification UI hosted by the service. No biometric data passes through your WordPress server. The plugin polls the API for session status and receives only a pass/fail result. * [Terms of Use](https://www.xyzinc.com/terms) * [Privacy Policy](https://www.xyzinc.com/privacy) * [Service information](https://www.xyzinc.com/wordpress-plugin) **Complete feature list:** * Two-tier verification: face liveness check, or liveness plus government ID * Region-specific rules with Cloudflare geo detection * Configurable minimum age per region (Tier 2 automatically enforced for thresholds above 18) * Exempt paths — leave specific URLs (homepage, privacy policy, registration, etc.) accessible to all visitors even from gated regions * QR code for mobile phone verification * Popup or same-device verification options * Real-time session status polling * Configurable bypass cookies for pre-verified users * Configurable fail-open or fail-closed behavior for API outages and credit exhaustion * Cryptographically signed verification cookies (HMAC-SHA256) * Server-side API key handling (never exposed to the browser) * Logged-in WordPress users automatically bypass the age gate * Built-in admin: manage regions, thresholds, and view verification history * Setup checklist and API health check on the settings page * Admin notices for common misconfigurations * Contextual help tabs with setup guide and troubleshooting * Compatible with standard WordPress page caches (not compatible with WP Rocket— see FAQ) ### Planned Features #### Media file protection — available now in XYZ Protect Media files in `/wp-content/uploads/` are served directly by your web server and do not pass through WordPress PHP execution, so a free WordPress plugin cannot restrict them. [XYZ Protect](https://www.xyzinc.com/protect) is a separate licensed plugin that solves this problem using a Cloudflare Worker — every media request is authorized before the file is served. XYZ Protect can be combined with this plugin for sites that need both page gating and file-level protection. #### Restricted path mode (planned) The current model gates the entire site for visitors from configured regions, with the new Exempt Paths feature (2.5.4) allowing specific URLs to bypass the gate. A future release will add the inverse model — **restricted paths** — where the gate applies only to specific URL paths (e.g., `/mature/`, `/adult-content/`) and the rest of the site is accessible without verification. * **Exempt paths** (current) is the right model for sites that are mostly age-restricted with a few accessible pages (homepage, privacy policy, registration). * **Restricted paths** (planned) is the right model for sites that are mostly accessible with a small age-restricted section — for example, sexuality education sites, media outlets with adult sections, or e-commerce stores with age-restricted product categories. #### Additional credit packs (available now) Credit packs are available for purchase via PayPal at [xyzinc.com/credits](https://www.xyzinc.com/credits). Purchased credits persist until used — they do not expire or reset monthly. Multiple packs can be stacked. Your first purchase includes a bonus of 300 credits and switches your site to prepaid billing, replacing the monthly free credit allocation. ### Third-Party Libraries This plugin includes the following third-party library: * **QRCode.js** — Client-side QR code generation - Source: [https://github.com/davidshimjs/qrcodejs](https://github.com/davidshimjs/qrcodejs) - License: MIT - Files: `assets/js/qrcode.js` (unminified source), `assets/js/qrcode.min.js`( minified) No build tools are required. The library is included as-is from the upstream repository with a minor CSS modification (image display style changed from “block” to “inline- block” for QR code placement). The unminified source is included for review. ## Capturas de tela [⌊Settings page with setup checklist and API health check⌉⌊Settings page with setup checklist and API health check⌉[ Settings page with setup checklist and API health check [⌊Age verification page with QR code and verification options⌉⌊Age verification page with QR code and verification options⌉[ Age verification page with QR code and verification options [⌊Region management with minimum age configuration⌉⌊Region management with minimum age configuration⌉[ Region management with minimum age configuration [⌊Exempt Paths tab — configure URLs that bypass the age gate⌉⌊Exempt Paths tab — configure URLs that bypass the age gate⌉[ Exempt Paths tab — configure URLs that bypass the age gate [⌊Recent verifications with detailed attempt history⌉⌊Recent verifications with detailed attempt history⌉[ Recent verifications with detailed attempt history [⌊Plan status showing credit usage and remaining balance⌉⌊Plan status showing credit usage and remaining balance⌉[ Plan status showing credit usage and remaining balance ## Instalação 1. Upload the `xyz-age-verification-free` folder to `/wp-content/plugins/`. 2. Activate the plugin through the “Plugins” menu in WordPress. 3. Go to **Settings > Age Verification**. 4. If you don’t have an API key, enter your email under “Get Started with a Free Plan” and click **Start Free Plan**. Check your email to confirm and receive your API key. 5. Enter your API key in the settings. 6. Click **Fetch from API** next to the Cookie Signing Key field to enable secure cookie verification. 7. Create a WordPress page with the slug `age-gate` and add the `[xyzav_age_verify]` shortcode to its content. 8. Copy `mu-plugin/xyz-age-gate-redirect.php` from the plugin folder to `/wp-content/ mu-plugins/`. Create the `mu-plugins` directory if it does not exist. 9. Go to **Settings > Free Plan** to configure your regions, welcome content, and verification thresholds. 10. If using a page cache plugin, exclude `/age-gate/` from caching. **Note: WP Rocket is not compatible** (see FAQ). 11. Check the Setup Checklist on the settings page to verify all steps are complete. ## Perguntas frequentes ### How is this different from other age verification plugins on WordPress.org? Most plugins listed under “age verification” are technically age **gates** — a popup with a “Yes, I’m 18+” button or a date-of-birth dropdown. A minor can pass these in seconds by clicking the right button or picking a year. They satisfy a checkbox- level compliance requirement but do not actually verify that the visitor is an adult. XYZ Age Verification performs real verification: a real-time selfie liveness check confirms a living person is present, and a trained classifier evaluates the probability that the person is a minor. Borderline cases automatically escalate to government ID verification. The result is a binary adult/not-adult determination backed by biometrics or a verifiable identity document — not a click. If a self-declaration popup is sufficient for your compliance needs, plenty of free plugins offer that. If you need real verification because of OFCOM, US state laws, EU requirements, or your platform’s own policies, this plugin is built for that. ### Where is my biometric data stored? Nowhere. Selfies, liveness frames, and government ID images are processed in real time by the verification service and discarded immediately after the session completes— regardless of the outcome. The only data retained is the verification result (pass/ fail), session metadata, a timestamp, and the visitor’s IP address (for fraud detection). Date of birth from ID documents is used transiently for age calculation and then discarded. Full details are in the [Privacy Policy](https://www.xyzinc.com/privacy). This is a fundamental architectural choice. The system does not maintain a database of faces, IDs, or verified identities, so there is no honeypot to breach. ### Is this plugin free? Yes. The plugin itself is completely free and open source. It connects to the XYZ Age Verification API, which includes a free plan with 100 verification credits per month — no credit card required. One credit is consumed per face liveness attempt, three credits total per document verification. Additional credit packs are available for purchase via PayPal at [xyzinc.com/credits](https://www.xyzinc.com/credits). Your first purchase includes 300 bonus credits and switches your site to a prepaid billing model — prepaid credits do not expire or reset monthly. ### What are verification credits? Credits represent verification attempts. Each face liveness check (Tier 1) costs 1 credit. Each document verification (Tier 2) costs 3 credits total. Your free plan includes 100 credits per month, resetting on the first of each month. Unused credits do not roll over. ### How does the system decide when to ask for ID? For age thresholds of 18, most visitors complete verification with a quick selfie. The liveness check includes a minor-probability assessment, and any result that crosses a conservative threshold automatically escalates to government ID verification. This means most adult visitors never see the ID step, while visitors whose appearance is ambiguous are asked for verifiable proof. For age thresholds above 18 (e.g., 21+ for alcohol, cannabis, or certain firearms content), ID verification is always required because a selfie alone cannot establish a specific age — only a date of birth from an ID document can. The plugin enforces this automatically for any region configured with a minimum age above 18. ### Does Tier 1 estimate the visitor’s age? No. Tier 1 produces a binary adult/not-adult determination, not an age estimate. The underlying classifier evaluates the probability that the subject is a minor; this probability drives the pass, fail, or escalate decision. The system never claims to know a visitor’s age from a selfie. Specific age thresholds (21+, 25+, etc.) require Tier 2 because only an ID document supplies a verifiable date of birth. ### What happens when my credits run out? This depends on your **API Failure Behavior** setting. In “fail open” mode (the default), visitors are allowed through unverified. In “fail closed” mode, visitors are redirected to an error page until credits reset or you purchase additional credits. Verifications already in progress are allowed to complete. You can purchase credit packs at any time from [xyzinc.com/credits](https://www.xyzinc.com/credits) — your first purchase includes 300 bonus credits. European site operators with regulatory compliance obligations typically need “fail closed.” ### Why does this plugin require Cloudflare? The plugin uses Cloudflare’s `CF-IPCountry` and `CF-Region-Code` headers to identify the country and (in the US) state that each visitor is connecting from. These headers are automatically added by Cloudflare’s network when your site is proxied through it. Without these headers, the plugin has no reliable way to determine where a visitor is connecting from, and region-specific verification rules cannot work. There is no alternative geo-detection method that meets the plugin’s accuracy and privacy requirements. Maxmind, IP2Location, and similar third-party databases are less accurate, require external lookups for every request, and would mean shipping IP addresses to additional services. Cloudflare’s headers are calculated server- side by Cloudflare itself, with no extra request needed. For more detail, see: [Why XYZ Age Verification requires Cloudflare](https://support.xyzinc.com/blog/18-why-the-xyz-age-verification-plugin-requires-cloudflare). ### The plugin shows a notice about missing Cloudflare headers. What does it mean? The plugin checks for three Cloudflare headers on admin page loads and shows a diagnostic notice if any are missing. There are three possible states: * **No `CF-Ray` header at all** — your site is not currently being served through Cloudflare. Either DNS migration is incomplete, or the proxy (orange cloud) is disabled on your A/AAAA records. Region-based verification cannot work until this is resolved. * **`CF-Ray` present, but no `CF-IPCountry`** — Cloudflare is in front of your site, but IP Geolocation is disabled. Enable it under **Rules Managed Transforms Add visitor location headers** in the Cloudflare dashboard. Available on the free plan. * **`CF-IPCountry` present, but no `CF-Region-Code`** — country-level rules work, but US state and other subdivision-level rules will not. Enable the full “Add visitor location headers” Managed Transform (not just the country variant) in the Cloudflare dashboard. Available on the free plan. The diagnostic reflects your current admin connection. If you administer the site via a VPN or another network that bypasses Cloudflare, the notice may appear even though visitors to your site are getting the headers correctly. The [Cloudflare setup guide](https://support.xyzinc.com/blog/2-2-cloudflare-setup) walks through verifying headers from a normal visitor connection. ### What does “setting up Cloudflare” actually involve? Setting up Cloudflare means changing your domain’s nameservers at your domain registrar to point at Cloudflare. Once Cloudflare is your DNS provider, all DNS records (A, AAAA, MX, TXT, CNAME) are managed in the Cloudflare dashboard instead of at your registrar. The migration has implications worth understanding before you begin: * **Email records must be preserved.** If your domain has email (MX records, SPF, DKIM, DMARC), those records must be re-created in Cloudflare exactly as they were before. If they are not, your email will stop working. * **Existing services that depend on DNS** — subdomain configurations, third-party integrations that ask you to add TXT records, SSL certificates managed outside Cloudflare — may need attention. * **DNS changes are not instant.** Nameserver changes can take up to 48 hours to propagate worldwide. Mistakes made during migration are not immediately reversible. If you have never managed your own DNS, or if your site’s email and other services are configured by someone else (a web host, an IT contractor), please read the [Cloudflare setup guide](https://support.xyzinc.com/blog/2-2-cloudflare-setup) before installing this plugin. The guide focuses specifically on preserving email and other services during the migration. **If migrating to Cloudflare is not something you are comfortable doing or paying someone to do, this plugin is not the right choice.** Simpler self-declaration age gate plugins do not require infrastructure changes, but they are not real verification— they are popups with no enforcement. Choose based on what your compliance obligations actually require. ### Can visitors see my homepage or registration page without going through verification? Yes, as of version 2.5.4. The plugin supports an **Exempt Paths** list — specific URLs that bypass the age gate entirely, even for visitors from gated regions. Common uses: * `/` — your homepage, so visitors can see what the site is before deciding to verify * `/privacy-policy/`, `/terms/` — legal pages that must be accessible without verification * `/register/`, `/login/`, `/contact/` — onboarding and contact pages Exact paths and `/*` wildcard prefixes are supported (e.g., `/public/*` exempts everything under `/public/`). Configure exempt paths in the new **Exempt Paths** tab in the plugin admin. **Important: do not exempt paths that contain age-restricted content.** Exemption means the path is accessible to all visitors regardless of region — including any underage visitors who might attempt to reach it directly. ### What happens if the API is unreachable? The behavior is controlled by the **API Failure Behavior** setting on the Age Verification settings page. “Fail open” (the default) allows visitors through unverified to prevent your site from going offline. “Fail closed” redirects visitors to an error page. Sites with compliance obligations should generally use “fail closed.” ### What is the must-use plugin for? The MU plugin (`xyz-age-gate-redirect.php`) runs early in the WordPress loading process, before most plugins. It checks Cloudflare geo headers and the verification cookie on every request, redirecting unverified visitors to the age gate page. This early execution is essential for the gate to work reliably and to prevent unverified visitors from briefly seeing protected content. ### Is this plugin compatible with WP Rocket? **No.** WP Rocket’s page cache serves static HTML files via its `advanced-cache. php` drop-in, which executes before must-use plugins load. This means WP Rocket can serve cached pages to unverified visitors, bypassing the gate entirely. WP Rocket does not currently offer a way to conditionally cache based on cookie presence. Other page cache plugins that respect the standard WordPress loading order are compatible— just exclude `/age-gate/` from caching. Confirmed compatible: WP Super Cache (Simple mode only), Jetpack Boost, and W3 Total Cache. ### Can visitors bypass the gate with browser dev tools? The verification cookie is cryptographically signed using HMAC-SHA256. Setting a fake cookie value will not pass signature verification. The verification logic runs at the must-use plugin level before any plugin-level code that could be tampered with via WordPress filters or hooks. ### Will the gate block me from my own WordPress admin? No. The `/wp-admin/` area and the login page are always exempted. All logged-in WordPress users are automatically bypassed at the redirect level, so administrators, editors, and other authenticated users will not encounter the gate while browsing the site. ### How does this work with membership or subscriber sites? The gate runs at the must-use plugin level, which executes before WordPress loads user roles. At this stage the plugin can detect that a visitor is logged in but cannot distinguish between an administrator and a regular member. As a result, ** all logged-in WordPress users bypass the gate**, not just administrators. For most sites this is not an issue — anonymous visitors are verified before they can register or log in, so members have already passed verification. However, if your site requires re-verification for content that logged-in members can also access( e.g., tiered content where some sections require re-verification), this plugin alone is not a fit for that use case. Plan your registration flow with this behavior in mind. If you need tighter integration with membership levels — for example, requiring different verification tiers for different membership levels, or protecting media files based on membership — [XYZ Protect](https://www.xyzinc.com/protect) integrates directly with MemberPress and Paid Memberships Pro to provide membership-aware authorization. It is a separate licensed plugin available at xyzinc.com. ### What is the Cookie Signing Key? The Cookie Signing Key is an HMAC-SHA256 secret used to cryptographically sign verification cookies. This prevents visitors from forging a verification cookie. The key is generated per-site by the XYZ API. Click “Fetch from API” on the settings page to set it up automatically. ### How do I know if the plugin is configured correctly? The settings page includes a Setup Checklist that shows green checkmarks for completed steps and red Xs for missing items. There is also an API Status indicator that tests the connection to the XYZ verification API. Click the Help tab at the top-right of the settings page for a full setup guide and troubleshooting tips. ### How do I test the age gate without being in a configured region? Enable **Test Mode** in Settings > Age Verification. Once enabled, anyone can add a `?reg=` query string parameter to any page URL to simulate a visitor from that region. For example, `?reg=US-TX` simulates a visitor from Texas, USA, and `?reg =DE` simulates a visitor from Germany. Test mode bypasses both the verification cookie and the logged-in user exemption, so you experience the full verification flow. This works in incognito/private browsing windows without a WordPress login, which is the most common way to test as an anonymous visitor. Remember to disable test mode when you are finished — a persistent admin notice will remind you. ### Does this plugin protect files in wp-content/uploads? No. The gate applies to WordPress pages and posts — it does not restrict direct access to media files served from `/wp-content/uploads/`. If a visitor knows or guesses the direct URL to an uploaded file, they can access it without verification. This is a limitation of the WordPress architecture: media files are served directly by the web server (Apache/Nginx) and do not pass through WordPress’s PHP execution. Protecting uploaded files requires server-level configuration beyond what a free WordPress plugin can provide. For full media file protection alongside age verification — covering images, videos, PDFs, and audio in `/wp-content/uploads/` — see [XYZ Protect](https://www.xyzinc.com/protect) at xyzinc.com. XYZ Protect adds a Cloudflare Worker layer that authorizes every media request before serving the file. ### What is the minimum age setting? Each region can have its own minimum age threshold (default is 18). For regions with a minimum age above 18, the plugin automatically requires Tier 2 verification( government ID) because Tier 1 (face liveness) can only assess minor probability, not exact age. The ID document is needed to extract the date of birth for precise age calculation. ## Avaliações ![](https://secure.gravatar.com/avatar/8b2e1e98d30df231998c6dd936d6cae6d9285050e4665c0bf7483514138df8c7? s=60&d=retro&r=g) ### 󠀁[Exceptional support and rapid fixes – five updates in one day](https://wordpress.org/support/topic/exceptional-support-and-rapid-fixes-five-updates-in-one-day/)󠁿 [signedadam](https://profiles.wordpress.org/signedadam/) 25 maio, 2026 1 resposta I ran into a problem where I couldn’t delete country‑wide region settings from the plug-in. I reached out to the developer and within an hour there was a fix I could download from the WordPress repository. That initial patch (I believe 2.5.2) fixed the 404 when editing or deleting country‑wide regions. What really impressed me was the follow‑through. Over the same day we worked through additional issues and the developer released 2.5.3, 2.5.4, 2.5.5, and 2.5.6 — five meaningful updates in one day. These weren’t tiny tweaks; they included new features, diagnostics, and important bug fixes. I’ve paid for apps that gave worse support over months, yet this developer provided prompt, effective help for free. If you want a plugin backed by an engaged maintainer who responds quickly and ships fixes fast, this is it. Highly recommended. Notable Changes I Saw (high level) 2.5.6 — Fixed Cloudflare admin notice false positives for setups that bypass Cloudflare on wp‑admin; probe now checks the public front end and caches results; “Re‑check now” added. 2.5.5 — Fixed a bug where the Bypass Cookies textarea rejected values and cleared stored data (bug present since ~2.4.2). 2.5.4 — Added Exempt Paths feature and improved Cloudflare diagnostic notices; documentation clarifications about Cloudflare requirements. 2.5.3 — MU plugin auto‑install/self‑heal added; improved admin notices for MU plugin state and repair behavior. 2.5.2 — Readme overhaul and the initial fix for deleting country‑wide regions (no more 404). Recommendation If you run an age‑gate and need a plugin that’s actively maintained and supported, this developer and plugin are excellent choices. Great responsiveness, clear changelogs, and practical fixes make it easy to trust this project for production sites. [ Leia a 1 avaliação ](https://wordpress.org/support/plugin/xyz-age-verification-free/reviews/) ## Colaboradores e desenvolvedores “XYZ Age Verification” é um programa de código aberto. As seguintes pessoas contribuíram para este plugin. Colaboradores * [ xyzageverify ](https://profiles.wordpress.org/xyzageverify/) [Traduzir o “XYZ Age Verification” para seu idioma.](https://translate.wordpress.org/projects/wp-plugins/xyz-age-verification-free) ### Interessado no desenvolvimento? [Navegue pelo código](https://plugins.trac.wordpress.org/browser/xyz-age-verification-free/), consulte o [repositório SVN](https://plugins.svn.wordpress.org/xyz-age-verification-free/) ou assine o [registro de desenvolvimento](https://plugins.trac.wordpress.org/log/xyz-age-verification-free/) por [RSS](https://plugins.trac.wordpress.org/log/xyz-age-verification-free/?limit=100&mode=stop_on_copy&format=rss). ## Registro de alterações #### 2.6.0 * New hardening option: **Verified-Bot Token** on the main settings page. Operators can now generate a 128-bit per-site secret token for the verified-bot bypass header and paste the same value into their Cloudflare Transform Rule, replacing the default `cf.client.bot` expression. This gives compliance-sensitive sites a defensible answer to “is there any documented bypass path?” — the bypass now requires a secret known only to the operator’s Cloudflare account and WordPress installation, with no shared default across sites. Header value comparison is constant-time. * Existing configurations continue to work without changes. The default token is the literal string that the basic Cloudflare Transform Rule already produces, so upgrading sites that have not opted into token rotation see no behavior change. * Cloudflare setup guide expanded: the verified-bot rule now documents both a basic configuration (matches the default) and a strong configuration (per-site token, recommended for stricter compliance posture). A new section walks operators through restricting their origin server’s HTTP/HTTPS access to Cloudflare’s published IP ranges — the strongest defense, since it closes both the bot-bypass and the geo-detection-bypass at the network layer. * Minimum PHP version raised from 7.4 to 8.2. PHP 7.4 reached end-of-life in November 2022 and PHP 8.0/8.1 are also no longer receiving security updates. A compliance- focused plugin should not require an unsupported language runtime. Sites still running PHP below 8.2 will continue to use 2.5.7 (auto-update will not offer 2.6.0 until PHP is upgraded). No code-level changes accompany this bump; it is a positioning and platform-hygiene change only. #### 2.5.7 * New setting: **Allow Verified Bots** on the main settings page. Previously, the MU plugin unconditionally let any request carrying a `verified-bot: true` header skip the age gate. That bypass is now operator-controlled via a checkbox (default enabled, so behavior for existing sites is unchanged). Disable if you want verified crawlers (Googlebot, Bingbot, etc.) to be redirected to the age gate alongside regular visitors. The header is populated by the Cloudflare Request Header Transform Rule described in the setup guide; if you have not configured that rule, this setting has no observable effect. #### 2.5.6 * Fix: the Cloudflare-header admin notice introduced in 2.5.4 would false-positive for operators whose wp-admin route deliberately bypasses Cloudflare (private reverse proxy on admin, separate admin hostname, Cloudflare Tunnel for admin only, etc.) — common and legitimate setups where the front-end is fully proxied and the age gate works perfectly for visitors. The check now probes the public front-end (via a token-gated REST endpoint). Probe result is cached for 12 hours, with a “Re-check now” link in the notice itself. All three diagnostic tiers ( CF not proxying, IP Geolocation off, Managed Transforms off) are still distinguished. #### 2.5.5 * Fix: the “Bypass Cookies” textarea on the main settings page would reject every value with `Bypass cookie name "["cookie"]" contains invalid characters`, regardless of what the operator typed, and silently clobber the stored value back to empty. The bug had been present since at least 2.4.2. #### 2.5.4 * New feature: **Exempt Paths** — operators can now configure specific URL paths( homepage, privacy policy, registration, etc.) that bypass the age gate entirely, even for visitors from gated regions. Supports exact paths and `/*` wildcard prefixes. Configure in the new Exempt Paths tab in the plugin admin. * New diagnostic: admin notices now detect missing Cloudflare geo headers and explain which Cloudflare dashboard setting needs to be enabled. Three-tier detection covers “not behind Cloudflare at all,” “IP Geolocation disabled,” and “country detection working but subdivision detection missing.” * Documentation: clarified that Cloudflare proxying is a deployment prerequisite, not a feature flag. Added explicit guidance on DNS migration implications (email preservation, propagation time, scope of change) and links to Cloudflare setup support articles. Made clear that this plugin is not appropriate for site owners not prepared to manage their own DNS. #### 2.5.3 * MU plugin is now auto-installed on plugin activation and self-heals on every page load if missing or out of date. Fixes a class of silent failures where a stale MU file left behind from a much earlier plugin version (using the old ` xyz_av_*` option namespace) would partially match region rules — state-specific rules added later would redirect correctly, but country-wide rules would silently fail. * New admin notice distinguishes MU plugin “not installed” from “out of date” from“ wp-content/mu-plugins/ not writable”, and only fires when the on-init auto-repair could not fix the situation. #### 2.5.2 * Documentation: readme overhaul focused on positioning and discoverability — clarified the distinction between age gates and real age verification, expanded FAQ with terminology and compliance context, added “When you need this plugin” section. * Fix: editing or deleting a country-wide region (no state code) from the admin no longer returns a 404. The plugin now sends the API’s documented `-` placeholder in the URL path when state code is empty. * Tested with WordPress 7.0. #### 2.5.1 * Credit pack purchasing via PayPal — purchase additional credits directly from xyzinc.com/credits * First credit pack purchase includes 300 bonus credits and switches the site to prepaid billing (replaces monthly free credit allocation) * Plan status panel now displays Prepaid plan with credit balance and purchase link * Free plan users see bonus credit incentive on the settings page #### 2.5.0 * Interstitial consent gate before session creation — no API call on page load, eliminating passive bot session consumption * Biometric consent checkbox serves as explicit user consent capture (supports BIPA/CIPA compliance requirements) * HMAC-signed timing gate rejects automated interactions faster than 1 second after page render * Visitor IP address now passed to the API for per-IP rate limiting (CF-Connecting- IP with REMOTE_ADDR fallback) * Verification UI dynamically rendered after consent via AJAX — same QR code, popup, and polling functionality * Added FAQ about wp-content/uploads limitation * Added planned features: media file protection and additional credit packs #### 2.4.2 * MU plugin: replaced cookie array iteration with direct computed cookie name lookup * MU plugin: enhanced phpcs:ignore annotations with detailed technical justifications #### 2.4.1 * Plugin display name simplified to “XYZ Age Verification” (removed redundant “ Free”) * Migrated Free Plan Admin data operations from AJAX to WP REST API (regions, content, thresholds, verifications) * Added HMAC verification to MU plugin redirect URLs for enhanced input validation * Documented QRCode.js third-party library source and license in readme * Added xyzageverify to plugin contributors #### 2.4.0 * Aligned text domain with WordPress.org assigned slug (xyz-age-verification-free) * Renamed all plugin identifiers to use xyzav_ prefix for WordPress.org compliance * Replaced inline scripts with properly enqueued JavaScript * Removed WordPress.org directory asset files from plugin ZIP * Added Domain Path header and languages directory #### 2.3.0 * Free plan registration directly from the plugin settings (100 credits/month, no credit card) * Built-in admin page for managing regions, welcome content, and thresholds * Detailed verification history with expandable attempt details * Minimum age setting per region with automatic Tier 2 enforcement for thresholds above 18 * Configurable fail-open/fail-closed behavior for API outages and credit exhaustion * Credit usage tracking with monthly reset * Site URL binding for free plan API keys * Test mode now works for all visitors (incognito window testing support) * Verification cookie HttpOnly flag disabled in test mode for easier testing * Plugin renamed to XYZ Age Verification #### 2.2.0 * Test mode: simulate any region with ?reg=US-TX query string * Cryptographically signed verification cookies with per-site HMAC-SHA256 keys * Logged-in WordPress users automatically bypass the age gate redirect * Setup checklist with status indicators on the settings page * API connection health check on the settings page * Admin notices for missing API key, MU plugin, age-gate page, and signing key * Contextual help tabs with overview, setup guide, settings reference, and troubleshooting * Restructured plugin with properly enqueued CSS and JS assets * Replaced external QR code service with bundled local generation (privacy improvement) * Added configurable bypass cookies for pre-verified users * Added internationalization (i18n) support for all user-facing strings * Added uninstall cleanup for all plugin options * Added activation hook with PHP and WordPress version checks * Added version constant for asset cache busting * Fixed file extension for proper WordPress plugin loading * Removed hardcoded client-specific default values * Added Host header security documentation in MU plugin #### 2.1.0 * Removed region query parameter override vulnerability (critical security fix) * Added nonce and capability checks to admin tool actions * Added sanitization callbacks to all registered settings * Added session ID format validation in AJAX poll handler * Removed client-specific hardcoded bypass cookies from MU plugin #### 2.0.0 * Initial public release * Two-tier verification (face liveness + government ID) * Region-specific rules via Cloudflare geo headers * QR code and popup verification options * Server-side API key handling * MU plugin architecture for early redirect (not compatible with WP Rocket page cache) ## Meta * Versão **2.6.0** * Última atualização **4 meses atrás** * Instalações ativas **Menos de 10** * Versão do WordPress ** 5.6 ou superior ** * Testado até **7.0.7** * Versão do PHP ** 8.2 ou superior ** * Idioma * [English (US)](https://wordpress.org/plugins/xyz-age-verification-free/) * Tags * [adults-only](https://br.wordpress.org/plugins/tags/adults-only/)[age gate](https://br.wordpress.org/plugins/tags/age-gate/) [age restriction](https://br.wordpress.org/plugins/tags/age-restriction/)[age verification](https://br.wordpress.org/plugins/tags/age-verification/) [age verify](https://br.wordpress.org/plugins/tags/age-verify/) * [Visualização avançada](https://br.wordpress.org/plugins/xyz-age-verification-free/advanced/) ## Classificações 5 de 5 estrelas. * [ 1 avaliação com 5 estrela ](https://wordpress.org/support/plugin/xyz-age-verification-free/reviews/?filter=5) * [ 0 avaliação com 4 estrela ](https://wordpress.org/support/plugin/xyz-age-verification-free/reviews/?filter=4) * [ 0 avaliação com 3 estrela ](https://wordpress.org/support/plugin/xyz-age-verification-free/reviews/?filter=3) * [ 0 avaliação com 2 estrela ](https://wordpress.org/support/plugin/xyz-age-verification-free/reviews/?filter=2) * [ 0 avaliação com 1 estrela ](https://wordpress.org/support/plugin/xyz-age-verification-free/reviews/?filter=1) [Sua avaliação](https://wordpress.org/support/plugin/xyz-age-verification-free/reviews/#new-post) [Ver todas avaliações](https://wordpress.org/support/plugin/xyz-age-verification-free/reviews/) ## Colaboradores * [ xyzageverify ](https://profiles.wordpress.org/xyzageverify/) ## Suporte Tem algo a dizer? Precisa de ajuda? [Ver fórum de suporte](https://wordpress.org/support/plugin/xyz-age-verification-free/)