by
XY Zinc
1 (1 reviews)
XYZ Age Verification
Real age verification for WordPress — biometric liveness detection and government ID verification, not just a checkbox.
XYZ Age Verification ranks #64,370 among WordPress.org plugins with 1+ active installations, a 1/5 rating from 1 reviews, and was last updated Mar 13, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Tested up to WP 6.9 (Current: 7.1.2)
v2.4.2
Current Version v2.4.2
Updated 6 months ago
Last Update on 13 Mar, 2026
Refreshed 11 hours ago
Last Refreshed on
Rank
#64,370
—
No change
Active Installs
1+
-50%
KW Avg Position
44.8
—
No change
Downloads
34
+2 today
Support Resolved
0%
—
No change
Rating
20%
Review 1 out of 5
1
(1 reviews)
Next Milestone 10
0+
10+
51,433
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 9 more installs to reach 10+
Rank Changes
Current
#64,370
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
1.0
1 reviews
Overall
20%
5
1
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 2.4.2
- Last Updated
- Mar 13, 2026
- Requires WP
- 5.6+
- Tested Up To
- 6.9
- PHP Version
- 8.2 or higher
- Author
- XY Zinc
Support & Rating
- Rating
- ★ ☆ ☆ ☆ ☆ 1
- Reviews
- 1
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade Now
Frequently Asked Questions
Common questions about XYZ Age Verification
Yes. The plugin itself is completely free and open source. It connects to the XYZ Age Verification API, which includes a free plan with 100 verification credits per month. One credit is consumed per face liveness attempt, and two credits per document verification attempt. Additional monthly credit packs are available for sites that need more capacity.
Credits represent verification attempts. Each face liveness check (Tier 1) costs 1 credit. Each document verification attempt (Tier 2) costs 2 credits. Your free plan includes 100 credits per month, which resets on the first of each month. Unused credits do not roll over.
This depends on your API Failure Behavior setting. In "fail open" mode (the default), visitors are allowed through unverified. In "fail closed" mode, visitors are redirected to an error page until credits reset or you purchase additional credits. Verifications that are already in progress when the limit is reached are allowed to complete.
The plugin uses Cloudflare's CF-IPCountry and CF-Region-Code headers to determine visitor location for region-specific age verification rules. These headers are added automatically when your site is proxied through Cloudflare. A free Cloudflare plan provides these headers.
The behavior is controlled by the API Failure Behavior setting on the Age Verification settings page. "Fail open" (the default) allows visitors through unverified to prevent your site from going offline. "Fail closed" redirects visitors to an error page. European site operators may need "fail closed" for regulatory compliance.
The MU plugin (xyz-age-gate-redirect.php) runs early in the WordPress loading process, before most plugins. It checks Cloudflare geo headers and the verification cookie on every request, redirecting unverified visitors to the age gate page. This early execution is essential for the age gate to work reliably.
No. WP Rocket's page cache serves static HTML files via its advanced-cache.php drop-in, which executes before must-use plugins load. This means WP Rocket can serve cached pages to unverified visitors, bypassing the age gate entirely. WP Rocket does not currently offer a way to conditionally cache based on cookie presence. Other page cache plugins that respect the standard WordPress loading order are compatible — just exclude /age-gate/ from caching.
The verification cookie is cryptographically signed using HMAC-SHA256. Setting a fake cookie value will not pass signature verification.
Only the verification result (pass/fail), session metadata, a timestamp, and the visitor's IP address (for fraud detection) are retained. Biometric data (face images, liveness frames) is processed in real-time and discarded immediately. No government ID content is stored — date of birth is used transiently for age calculation and then discarded. Full details can be found in the Privacy Policy.
No. The /wp-admin/ area and the login page are always exempted from the age gate. Additionally, all logged-in WordPress users are automatically bypassed at the redirect level, so administrators, editors, and other authenticated users will not encounter the age gate while browsing the site.