by
xyzageverify
5 (1 reviews)
XYZ Age Verification
Real age verification for WordPress — biometric liveness and government ID, not a checkbox. Built for OFCOM, US state, and EU compliance.
XYZ Age Verification ranks #69,241 among WordPress.org plugins with 1+ active installations, a 5/5 rating from 1 reviews, and was last updated Jun 3, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Tested up to WP 7 (Current: 7.1.4)
v2.6.0
Current Version v2.6.0
Updated 5 months ago
Last Update on 03 Jun, 2026
Refreshed 1 week ago
Last Refreshed on
Rank
#69,241
—
No change
Active Installs
1+
-50%
KW Avg Position
23.4
—
No change
Downloads
214
+4 today
Support Resolved
0%
—
No change
Rating
100%
Review 5 out of 5
5
(1 reviews)
Next Milestone 10
0+
10+
56,304
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 9 more installs to reach 10+
Rank Changes
Current
#69,241
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
5.0
1 reviews
Overall
100%
5
1
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 2.6.0
- Last Updated
- Jun 03, 2026
- Requires WP
- 5.6+
- Tested Up To
- 7
- PHP Version
- 8.2 or higher
- Author
- xyzageverify
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 5
- Reviews
- 1
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade Now
Frequently Asked Questions
Common questions about XYZ Age Verification
Most plugins listed under "age verification" are technically age gates — a popup with a "Yes, I'm 18+" button or a date-of-birth dropdown. A minor can pass these in seconds by clicking the right button or picking a year. They satisfy a checkbox-level compliance requirement but do not actually verify that the visitor is an adult. XYZ Age Verification performs real verification: a real-time selfie liveness check confirms a living person is present, and a trained classifier evaluates the probability that the person is a minor. Borderline cases automatically escalate to government ID verification. The result is a binary adult/not-adult determination backed by biometrics or a verifiable identity document — not a click. If a self-declaration popup is sufficient for your compliance needs, plenty of free plugins offer that. If you need real verification because of OFCOM, US state laws, EU requirements, or your platform's own policies, this plugin is built for that.
Nowhere. Selfies, liveness frames, and government ID images are processed in real time by the verification service and discarded immediately after the session completes — regardless of the outcome. The only data retained is the verification result (pass/fail), session metadata, a timestamp, and the visitor's IP address (for fraud detection). Date of birth from ID documents is used transiently for age calculation and then discarded. Full details are in the Privacy Policy. This is a fundamental architectural choice. The system does not maintain a database of faces, IDs, or verified identities, so there is no honeypot to breach.
Yes. The plugin itself is completely free and open source. It connects to the XYZ Age Verification API, which includes a free plan with 100 verification credits per month — no credit card required. One credit is consumed per face liveness attempt, three credits total per document verification. Additional credit packs are available for purchase via PayPal at xyzinc.com/credits. Your first purchase includes 300 bonus credits and switches your site to a prepaid billing model — prepaid credits do not expire or reset monthly.
Credits represent verification attempts. Each face liveness check (Tier 1) costs 1 credit. Each document verification (Tier 2) costs 3 credits total. Your free plan includes 100 credits per month, resetting on the first of each month. Unused credits do not roll over.
For age thresholds of 18, most visitors complete verification with a quick selfie. The liveness check includes a minor-probability assessment, and any result that crosses a conservative threshold automatically escalates to government ID verification. This means most adult visitors never see the ID step, while visitors whose appearance is ambiguous are asked for verifiable proof. For age thresholds above 18 (e.g., 21+ for alcohol, cannabis, or certain firearms content), ID verification is always required because a selfie alone cannot establish a specific age — only a date of birth from an ID document can. The plugin enforces this automatically for any region configured with a minimum age above 18.
No. Tier 1 produces a binary adult/not-adult determination, not an age estimate. The underlying classifier evaluates the probability that the subject is a minor; this probability drives the pass, fail, or escalate decision. The system never claims to know a visitor's age from a selfie. Specific age thresholds (21+, 25+, etc.) require Tier 2 because only an ID document supplies a verifiable date of birth.
This depends on your API Failure Behavior setting. In "fail open" mode (the default), visitors are allowed through unverified. In "fail closed" mode, visitors are redirected to an error page until credits reset or you purchase additional credits. Verifications already in progress are allowed to complete. You can purchase credit packs at any time from xyzinc.com/credits — your first purchase includes 300 bonus credits. European site operators with regulatory compliance obligations typically need "fail closed."
The plugin uses Cloudflare's CF-IPCountry and CF-Region-Code headers to identify the country and (in the US) state that each visitor is connecting from. These headers are automatically added by Cloudflare's network when your site is proxied through it. Without these headers, the plugin has no reliable way to determine where a visitor is connecting from, and region-specific verification rules cannot work. There is no alternative geo-detection method that meets the plugin's accuracy and privacy requirements. Maxmind, IP2Location, and similar third-party databases are less accurate, require external lookups for every request, and would mean shipping IP addresses to additional services. Cloudflare's headers are calculated server-side by Cloudflare itself, with no extra request needed. For more detail, see: Why XYZ Age Verification requires Cloudflare.
The plugin checks for three Cloudflare headers on admin page loads and shows a diagnostic notice if any are missing. There are three possible states: No CF-Ray header at all — your site is not currently being served through Cloudflare. Either DNS migration is incomplete, or the proxy (orange cloud) is disabled on your A/AAAA records. Region-based verification cannot work until this is resolved. CF-Ray present, but no CF-IPCountry — Cloudflare is in front of your site, but IP Geolocation is disabled. Enable it under Rules → Managed Transforms → Add visitor location headers in the Cloudflare dashboard. Available on the free plan. CF-IPCountry present, but no CF-Region-Code — country-level rules work, but US state and other subdivision-level rules will not. Enable the full "Add visitor location headers" Managed Transform (not just the country variant) in the Cloudflare dashboard. Available on the free plan. The diagnostic reflects your current admin connection. If you administer the site via a VPN or another network that bypasses Cloudflare, the notice may appear even though visitors to your site are getting the headers correctly. The Cloudflare setup guide walks through verifying headers from a normal visitor connection.
Setting up Cloudflare means changing your domain's nameservers at your domain registrar to point at Cloudflare. Once Cloudflare is your DNS provider, all DNS records (A, AAAA, MX, TXT, CNAME) are managed in the Cloudflare dashboard instead of at your registrar. The migration has implications worth understanding before you begin: Email records must be preserved. If your domain has email (MX records, SPF, DKIM, DMARC), those records must be re-created in Cloudflare exactly as they were before. If they are not, your email will stop working. Existing services that depend on DNS — subdomain configurations, third-party integrations that ask you to add TXT records, SSL certificates managed outside Cloudflare — may need attention. DNS changes are not instant. Nameserver changes can take up to 48 hours to propagate worldwide. Mistakes made during migration are not immediately reversible. If you have never managed your own DNS, or if your site's email and other services are configured by someone else (a web host, an IT contractor), please read the Cloudflare setup guide before installing this plugin. The guide focuses specifically on preserving email and other services during the migration. If migrating to Cloudflare is not something you are comfortable doing or paying someone to do, this plugin is not the right choice. Simpler self-declaration age gate plugins do not require infrastructure changes, but they are not real verification — they are popups with no enforcement. Choose based on what your compliance obligations actually require.