cookers DEVELOPMENT

<p>This plugin provides an overlay for each website user to confirm his age (or different things – the text is fully costomizable in the options). On right answer, a cookie is set to remember the user for a set amount of days and not show the nag screen again. Otherwise, a custom message is shown to the user and the access to the site is not granted.</p>
<p>The plugin was initially developed for the age restriction of selling alcoholic beverages in a webshop. Due to legal reasons, such an age restriction must be in place (depending of the country of operation).</p>


Quick Age Verification

Presents each site user a quick age verification screen before using the site. Saves the response in a cookie for further visits.

xyzageverify

<p>XYZ Age Verification provides real age verification for WordPress sites that need to comply with age-gating regulations. Unlike simple “click to confirm” plugins, XYZ uses biometric liveness detection and optional government ID verification to confirm that a visitor is not a minor.</p>
<p><strong>How it works:</strong></p>
<ol>
<li>Visitors from configured regions are redirected to an age gate page.</li>
<li>They complete a face liveness check (Tier 1) or liveness + government ID verification (Tier 2).</li>
<li>Upon verification, a secure cookie is set and the visitor is granted access.</li>
<li>All biometric data is processed in real-time and is not stored.</li>
</ol>
<p><strong>Key features:</strong></p>
<ul>
<li>Two-tier verification: face liveness check or liveness + government ID</li>
<li>Region-specific rules with Cloudflare geo detection</li>
<li>Configurable minimum age per region (Tier 2 auto-enforced for non-18 thresholds)</li>
<li>QR code for mobile phone verification</li>
<li>Popup or same-device verification options</li>
<li>Real-time session status polling</li>
<li>Configurable bypass cookies for pre-verified users</li>
<li>Configurable fail-open or fail-closed behavior for API outages and credit exhaustion</li>
<li>Cryptographically signed verification cookies (HMAC-SHA256)</li>
<li>Server-side API key handling (never exposed to the browser)</li>
<li>Logged-in WordPress users automatically bypass the age gate</li>
<li>Built-in free plan admin: manage regions, thresholds, and view verification history</li>
<li>Setup checklist and API health check on the settings page</li>
<li>Admin notices for common misconfigurations</li>
<li>Contextual help tabs with setup guide and troubleshooting</li>
<li>Compatible with standard WordPress page caches (not compatible with WP Rocket — see FAQ)</li>
<li>Privacy-focused: no biometric data stored</li>
</ul>
<p><strong>Free plan included:</strong></p>
<p>This plugin includes a free plan with 100 verification credits per month — no credit card required. Register directly from the plugin settings page with just your email address. Credits reset monthly and do not roll over. Additional credit packs are available for sites that need more capacity.</p>
<p><strong>Requirements:</strong></p>
<ul>
<li>An XYZ Age Verification API key (register for a free plan directly from the plugin settings, or sign up at <a href="https://www.xyzinc.com/wordpress-plugin" rel="nofollow ugc">xyzinc.com</a>)</li>
<li>Cloudflare proxying — free plan or higher (required for geo detection headers <code>CF-IPCountry</code> and <code>CF-Region-Code</code>)</li>
<li>HTTPS enabled</li>
</ul>
<p><strong>External service — XYZ Age Verification API:</strong></p>
<p>This plugin connects to the XYZ Age Verification API at <code>https://age-verify.xyzinc.com</code>, operated by XY Zinc (a brand of Chaos Unlimited LLC), to perform biometric liveness detection and government ID document verification. The plugin cannot function without this service — it is the core verification engine.</p>
<p>When a visitor triggers age verification, the plugin sends the visitor’s country and state codes (derived from Cloudflare headers) to the API to create a verification session. The visitor then interacts directly with the verification UI hosted by the service. No biometric data passes through your WordPress server. The plugin polls the API for session status and receives only a pass/fail result.</p>
<ul>
<li><a href="https://www.xyzinc.com/terms" rel="nofollow ugc">Terms of Use</a></li>
<li><a href="https://www.xyzinc.com/privacy" rel="nofollow ugc">Privacy Policy</a></li>
<li><a href="https://www.xyzinc.com/wordpress-plugin" rel="nofollow ugc">Service information</a></li>
</ul>
<h3>Planned Features</h3>
<p>The following enhancements are planned for future releases:</p>
<h4>Restricted path mode (Pro)</h4>
<p>Currently the age gate applies to your entire site based on visitor region. A future release of the Pro plugin will add a <strong>restricted paths</strong> mode, allowing site owners to age-gate only specific URL paths (e.g., <code>/mature/</code>, <code>/adult-content/</code>) while leaving the rest of the site accessible without verification. This is ideal for sites that contain a mix of general and age-restricted content — such as sexuality education sites, media outlets with adult sections, or e-commerce stores with age-restricted product categories.</p>
<h4>Additional credit packs</h4>
<p>Credit packs will be available for purchase via PayPal for sites that need more capacity. Purchased credits will be added to a prepaid balance that persists until used — they will not expire or reset monthly. Multiple packs can be stacked.</p>
<h4>Media file protection</h4>
<p>We are investigating methods to extend age gate protection to files served from <code>/wp-content/uploads/</code>. Because media files are served directly by the web server and do not pass through WordPress PHP execution, this requires server-level solutions (e.g., Nginx/Apache rewrite rules, signed URLs, or a PHP-based file proxy). A future release will provide guidance and/or built-in support for common hosting configurations.</p>
<h3>Third-Party Libraries</h3>
<p>This plugin includes the following third-party library:</p>
<ul>
<li><strong>QRCode.js</strong> — Client-side QR code generation
<ul>
<li>Source: <a href="https://github.com/davidshimjs/qrcodejs" rel="nofollow ugc">https://github.com/davidshimjs/qrcodejs</a></li>
<li>License: MIT</li>
<li>Files: <code>assets/js/qrcode.js</code> (unminified source), <code>assets/js/qrcode.min.js</code> (minified)</li>
</ul>
</li>
</ul>
<p>No build tools are required. The library is included as-is from the upstream repository with a minor CSS modification (image display style changed from “block” to “inline-block” for QR code placement). The unminified source is included in the plugin for review.</p>


XYZ Age Verification

Real age verification for WordPress — biometric liveness detection and government ID verification, not just a checkbox.

Quick Age Verification vs XYZ Age Verification