AgeWallet OIDC Client

The AgeWallet OIDC Client plugin adds age verification and content gating to your WordPress website, backed by the AgeWallet™ verification service over OpenID Connect (OIDC). It is designed to be straightforward to set up, fully customizable, and compatible with all WordPress hosting environments — including sites behind aggressive page caches (Cloudflare, Varnish, WP Rocket, LiteSpeed, etc.). Two protection modes are available. Standard (Overlay) mode hides gated content via a client-side overlay; it is SEO-friendly and works on any cached page. High Security (Strict) mode short-circuits the page entirely until the visitor verifies, using a cookieless "skeleton" template that pairs with "Cache Everything" CDN rules. Customize the gate's appearance from the Gate Appearance tab (logo, copy, colours, button radii) and override anything else from Appearance → Customize → Additional CSS. Strict-mode analytics — Google Analytics 4, Google Tag Manager, and Facebook Pixel — are configurable from the Strict Mode Analytics tab. Protection rules cover the whole site, individual URL paths, taxonomies (categories, tags, custom taxonomies), per-post overrides via the editor sidebar, and the [agewallet_protected] shortcode for inline content. WooCommerce is supported out of the box with three checkout-gate modes and per-product / per-category regulated flagging. Every verification can carry an opaque metadata payload (≤4KB) that round-trips through the OIDC flow and surfaces on the /userinfo response, letting integrators correlate verifications with their own backend records. For the full feature enumeration see Other Notes; for setup walkthroughs, the available CSS hooks, and the developer-hook list, see the Usage Guide, CSS Customization Guide, and Developer Hooks sections below.

Features

• Legal compliance: leverages the AgeWallet™ service, designed to comply with modern age-verification laws in major jurisdictions.
• Secure verification flow: OIDC Authorization Code Flow with PKCE.
• Cryptographic cookie integrity: HMAC-signed verification cookies, mathematically verified server-side.
• Two protection modes:
• Standard (Overlay): a lightweight, SEO-friendly overlay that hides content via CSS and JavaScript.
• High Security (Strict): prevents protected content from loading until verification is complete. Uses a cookieless skeleton page compatible with "Cache Everything" CDN rules.
• Smart caching architecture: Strict mode uses a split-cache system (singular vs. archives) for fast performance with immediate invalidation when content changes.
• Automated cache management: configurable garbage-collection schedule plus invalidation triggers for menu / theme / taxonomy changes.
• Fully customizable gate appearance: dedicated logo, WYSIWYG copy editor, colour pickers (overlay / card / text / buttons), card and button border-radius, plus Customizer Additional CSS for advanced overrides.
• Strict-mode analytics: structured Google Analytics 4, Google Tag Manager, and Facebook Pixel ID fields render the official snippets directly into the skeleton page (where the theme's own analytics tags can't fire).
• Flexible content protection rules:
• Full-site protection (with or without the homepage).
• Granular taxonomy control across Categories, Tags, and Custom Taxonomies (e.g. WooCommerce Product Categories).
• Path-based protection on specific URL paths (e.g. /shop/, /videos/premium/).
• Per-post overrides via the editor sidebar.
• Inline [agewallet_protected] shortcode for specific page elements.
• WooCommerce integration:
• Three checkout-gate modes: Off, Force Always, Conditional on Cart.
• Per-product regulated controls: Not Regulated / Regulated / Override.
• Per-category and per-tag regulated flagging on the term-edit screens (products inherit from any of their categories or tags).
• Cart-context metadata (cart hash, total, currency, line-item count, billing country) automatically attached to verifications. In Conditional-on-Cart mode, a cart_triggers audit trail captures which products / categories / tags fired the gate.
• Metadata pass-through: attach an opaque per-verification string (up to 4 KB) — static text or auto-composed JSON of selected request-context fields — that round-trips through the OIDC flow and surfaces on the /userinfo response.

1.5.6

• Security: Improved script and style handling on the age-gate loading screen and post-verification handoff page.
• Security: Hardened content escaping in the [agewallet_protected] shortcode.
• UX: The AgeWallet admin screens now show a prominent "Register at agewallet.io" prompt when the Client ID or Client Secret is missing. The prompt hides automatically once both are saved.
• Docs: Updated the Usage Guide and FAQ with the new https://app.agewallet.io/register signup URL.

1.5.5

• Docs: Added an "External services" section documenting the AgeWallet verification service and optional Strict-mode analytics integrations (Google Analytics 4, Google Tag Manager, Facebook Pixel), each with the provider's Terms and Privacy links.
• Security: Improved script handling and output escaping across the admin and gate paths.
• Fix: The [agewallet_protected] shortcode no longer triggers the full-page overlay on otherwise-ungated pages — it renders its inline placeholder only.
• Fix: Gate Appearance colours and border-radii now apply consistently in both Standard and Strict modes; a blank radius field uses the rounded default instead of squared corners.
• Docs: Removed three readme references to action hooks the plugin does not actually fire.

1.5.4

• Structured Gate Appearance form: dedicated colour pickers (overlay backdrop, card background and border, body and disclaimer text, Agree / Disagree buttons) and card / button border-radius inputs replace the previous free-text "Custom CSS" field. Defaults match the previous look; saving without changes produces no visual diff.
• Strict Mode Analytics: dedicated Google Analytics 4 Measurement ID, Google Tag Manager Container ID, and Facebook Pixel ID fields replace the previous free-text Header / Footer Scripts inputs. AgeWallet now renders the canonical official snippets for each provider when the corresponding ID is set.
• Customizer-driven custom CSS: arbitrary CSS overrides should now live in Appearance → Customize → Additional CSS. AgeWallet automatically renders the Customizer's saved CSS into the Strict-mode skeleton (it already applies on Standard mode via the normal WordPress lifecycle). For exotic per-site needs (custom fonts, non-standard analytics providers), use the agewallet_skeleton_head / agewallet_skeleton_footer action hooks listed in the Developer Hooks guide.
• Text domain renamed to agewallet-oidc-client. Plugin folder, main file, and Text Domain header aligned.
• Security: Admin styles moved into an enqueued stylesheet; tightened debug-log input sanitisation and shortcode escape annotations.
• The previous agewallet_custom_css, agewallet_head_scripts, and agewallet_footer_scripts options are removed; their stored values (if any) are cleared by uninstall.php on plugin deletion.

1.5.3

• Security: Comprehensive input-sanitisation, output-escaping, and internationalisation cleanup across the plugin.
• Compatibility: Minimum WordPress version raised from 5.8 to 6.0.

1.5.2

• Compatibility: Added WC requires at least / WC tested up to plugin headers and declared WooCommerce High-Performance Order Storage (HPOS) compatibility.

1.5.1

• Maintenance: Housekeeping and licence declaration. Added uninstall.php for clean removal of options, scheduled cron events, and the strict-mode cache directory.

1.4.0

• Feature: Metadata pass-through. An opaque per-verification string (up to 4096 bytes) can now be attached to every AgeWallet verification. The Credentials page exposes a "Metadata source" picker with three modes: Off, Static text (literal string), and Auto JSON (compose from selected fields across post, user, request, and archive context groups). Metadata is computed at gate-render time and HMAC-signed for transport via the launch URL. Two filter hooks let developers extend: agewallet_auto_metadata (array, before encoding) and agewallet_metadata (final string, after encoding). Read back with agewallet_get_metadata().
• Feature: WooCommerce checkout gating. New three-state Checkout Gating control on the Content Guarding page (visible only when WooCommerce is active): Off (no checkout-specific rule), Force Always (every checkout gates), or Conditional on Cart (gate fires only when the cart contains items flagged as regulated). Regulated status is set per-product via a new "AgeWallet" tab in the product data metabox (Not Regulated / Regulated / Override) or per-category and per-tag via a Regulated checkbox on the term edit screens. Per-checkout cart context (cart hash, total, currency, line item count, billing country) is composed into the verification metadata and merged with any site-level metadata. When Conditional on Cart mode fires the gate, a cart_triggers audit field captures the product, category, and tag IDs that triggered. Filters: agewallet_wc_checkout_metadata, agewallet_cart_has_regulated_items, agewallet_regulated_cart_triggers.
• Safety: Strict-mode cache automatically skips WooCommerce checkout, cart, and my-account pages. Caching cart-bearing pages would either render an empty cart in the cookieless loopback or leak one customer's HTML to another, so these pages always render live.
• Dev: New helper agewallet_get_metadata() and AgeWallet_Helpers::get_verified_cookie_payload(). Cart-inspection methods exposed on AgeWallet_WooCommerce: checkout_gating_mode, cart_contains_regulated_items, get_regulated_triggers, product_is_regulated. Programmatic flagging via post meta (_agewallet_regulated_status on products) and term meta (agewallet_regulated on product_cat and product_tag).

1.3.1

• Fix: On verification failure, redirect user back to originating page so the age gate re-triggers, rather than showing a misleading "cancelled or denied" message.

1.3.0

• Architecture: Implemented High Security (Strict) Mode with API-based content retrieval.
• Architecture: Added Split-Cache system (Singular/Archive) for intelligent invalidation.
• Compatibility: Switched verification triggers to POST requests to bypass aggressive host caching (WP Engine, etc).
• UX: Refactored Admin Settings into a multi-step Wizard.
• Feature: Added Manual Cache Purge tool.
• Security: Implemented HMAC cryptographic signing for verification cookies to prevent forgery.
• Feature: Added granular Taxonomy Gating (support for Categories, Tags, and Custom Taxonomies).
• Feature: Added "Cache Control" settings with configurable auto-purge schedule (WP-Cron).
• Feature: Extended automatic cache invalidation to include Menu, Theme, and Term updates.
• Dev: Added multiple new hooks for deep customization of cookies, caching, and taxonomy rules.

1.2.0

• Patched 2 bugs preventing shortcode from working properly in some environments.

1.0.1

• CSS and Documentation tweaks.

1.0.0

• Feature: Added an in-dashboard "Plugin Guide" page that displays the plugin's readme file.

0.1.7

• Tweak: Standardized all front-end CSS class names for better consistency and to prevent theme conflicts.
• Tweak: Converted the "I Agree" link into a <button> element for better styling compatibility across themes.
• Feature: Added numerous developer hooks and filters for improved extensibility.
• Security: Hardened client-side script by adding click handlers dynamically instead of using inline attributes.