AgeWallet – Age Verification & Age Estimation for WordPress & WooCommerce

AgeWallet adds age verification and age estimation to your WordPress website, with content gating and an age-gated checkout for WooCommerce. Verification is backed by the AgeWallet™ service over OpenID Connect (OIDC), giving your WordPress or WooCommerce store a compliant, privacy-respecting age gate that visitors complete once. Whether you need document-based age verification, AI-assisted age estimation, or a full content-gating age gate, AgeWallet is straightforward to set up, fully customizable, and works on every WordPress host — including sites behind aggressive page caches (Cloudflare, Varnish, WP Rocket, LiteSpeed). Age verification and age estimation methods Multiple age-assurance methods are supported, so you can meet age-restriction requirements without collecting or storing sensitive identity data yourself. Every verification can carry an opaque metadata payload (≤4KB) that round-trips through the OIDC flow and surfaces on /userinfo, letting integrators correlate age checks with their own records. Two protection modes Standard (Overlay) hides gated content via a client-side overlay — SEO-friendly, works on any cached page. High Security (Strict) short-circuits the page entirely until the visitor passes age verification, using a cookieless "skeleton" template that pairs with "Cache Everything" CDN rules. Built for WooCommerce WooCommerce is supported out of the box: three checkout-gate modes plus per-product / per-category regulated flagging, so age-restricted items require age verification before checkout while the rest of your catalog stays open. Flexible age-gate rules Rules cover the whole site, individual URL paths, taxonomies (categories, tags, custom taxonomies), per-post overrides via the editor sidebar, and the [agewallet_protected] shortcode for inline content — so you gate exactly where your content needs it. Fully customizable gate Customize the age gate from the Gate Appearance tab (logo, copy, colours, button radii) and override anything else from Appearance → Customize → Additional CSS. Strict-mode analytics (Google Analytics 4, Google Tag Manager, Facebook Pixel) are configurable from the Strict Mode Analytics tab. For the full feature list see Other Notes. Setup walkthroughs, the CSS hook reference, and the developer hook list ship with the plugin — see AgeWallet → Usage Guide, CSS Guide, and Developer Hooks in your WordPress admin.

Features

• Legal compliance: leverages the AgeWallet™ service, designed to comply with modern age-verification laws in major jurisdictions.
• Secure verification flow: OIDC Authorization Code Flow with PKCE.
• Cryptographic cookie integrity: HMAC-signed verification cookies, mathematically verified server-side.
• Two protection modes:
• Standard (Overlay): a lightweight, SEO-friendly overlay that hides content via CSS and JavaScript.
• High Security (Strict): prevents protected content from loading until verification is complete. Uses a cookieless skeleton page compatible with "Cache Everything" CDN rules.
• Smart caching architecture: Strict mode uses a split-cache system (singular vs. archives) for fast performance with immediate invalidation when content changes.
• Automated cache management: configurable garbage-collection schedule plus invalidation triggers for menu / theme / taxonomy changes.
• Fully customizable gate appearance: dedicated logo, WYSIWYG copy editor, colour pickers (overlay / card / text / buttons), card and button border-radius, plus Customizer Additional CSS for advanced overrides.
• Strict-mode analytics: structured Google Analytics 4, Google Tag Manager, and Facebook Pixel ID fields render the official snippets directly into the skeleton page (where the theme's own analytics tags can't fire).
• Flexible content protection rules:
• Full-site protection (with or without the homepage).
• Granular taxonomy control across Categories, Tags, and Custom Taxonomies (e.g. WooCommerce Product Categories).
• Path-based protection on specific URL paths (e.g. /shop/, /videos/premium/).
• Per-post overrides via the editor sidebar.
• Inline [agewallet_protected] shortcode for specific page elements.
• WooCommerce integration:
• Three checkout-gate modes: Off, Force Always, Conditional on Cart.
• Per-product regulated controls: Not Regulated / Regulated / Override.
• Per-category and per-tag regulated flagging on the term-edit screens (products inherit from any of their categories or tags).
• Cart-context metadata (cart hash, total, currency, line-item count, billing country) automatically attached to verifications. In Conditional-on-Cart mode, a cart_triggers audit trail captures which products / categories / tags fired the gate.
• Metadata pass-through: attach an opaque per-verification string (up to 4 KB) — static text or auto-composed JSON of selected request-context fields — that round-trips through the OIDC flow and surfaces on the /userinfo response.

1.5.7

• Docs: Documentation improvements.

1.5.6

• Security: Improved script and style handling on the age-gate loading screen and post-verification handoff page.
• Security: Hardened content escaping in the [agewallet_protected] shortcode.
• UX: The AgeWallet admin screens now show a prominent "Register at agewallet.io" prompt when the Client ID or Client Secret is missing. The prompt hides automatically once both are saved.
• Docs: Updated the Usage Guide and FAQ with the new https://app.agewallet.io/register signup URL.

1.5.5

• Docs: Added an "External services" section documenting the AgeWallet verification service and optional Strict-mode analytics integrations (Google Analytics 4, Google Tag Manager, Facebook Pixel), each with the provider's Terms and Privacy links.
• Security: Improved script handling and output escaping across the admin and gate paths.
• Fix: The [agewallet_protected] shortcode no longer triggers the full-page overlay on otherwise-ungated pages — it renders its inline placeholder only.
• Fix: Gate Appearance colours and border-radii now apply consistently in both Standard and Strict modes; a blank radius field uses the rounded default instead of squared corners.
• Docs: Removed three readme references to action hooks the plugin does not actually fire.

1.5.4

• Structured Gate Appearance form: dedicated colour pickers (overlay backdrop, card background and border, body and disclaimer text, Agree / Disagree buttons) and card / button border-radius inputs replace the previous free-text "Custom CSS" field. Defaults match the previous look; saving without changes produces no visual diff.
• Strict Mode Analytics: dedicated Google Analytics 4 Measurement ID, Google Tag Manager Container ID, and Facebook Pixel ID fields replace the previous free-text Header / Footer Scripts inputs. AgeWallet now renders the canonical official snippets for each provider when the corresponding ID is set.
• Customizer-driven custom CSS: arbitrary CSS overrides should now live in Appearance → Customize → Additional CSS. AgeWallet automatically renders the Customizer's saved CSS into the Strict-mode skeleton (it already applies on Standard mode via the normal WordPress lifecycle). For exotic per-site needs (custom fonts, non-standard analytics providers), use the agewallet_skeleton_head / agewallet_skeleton_footer action hooks listed in the Developer Hooks guide.
• Text domain renamed to agewallet-oidc-client. Plugin folder, main file, and Text Domain header aligned.
• Security: Admin styles moved into an enqueued stylesheet; tightened debug-log input sanitisation and shortcode escape annotations.
• The previous agewallet_custom_css, agewallet_head_scripts, and agewallet_footer_scripts options are removed; their stored values (if any) are cleared by uninstall.php on plugin deletion.

1.5.3

• Security: Comprehensive input-sanitisation, output-escaping, and internationalisation cleanup across the plugin.
• Compatibility: Minimum WordPress version raised from 5.8 to 6.0.

1.5.2

• Compatibility: Added WC requires at least / WC tested up to plugin headers and declared WooCommerce High-Performance Order Storage (HPOS) compatibility.

1.5.1

• Maintenance: Housekeeping and licence declaration. Added uninstall.php for clean removal of options, scheduled cron events, and the strict-mode cache directory.

1.4.0

• Feature: Metadata pass-through. An opaque per-verification string (up to 4096 bytes) can now be attached to every AgeWallet verification. The Credentials page exposes a "Metadata source" picker with three modes: Off, Static text (literal string), and Auto JSON (compose from selected fields across post, user, request, and archive context groups). Metadata is computed at gate-render time and HMAC-signed for transport via the launch URL. Two filter hooks let developers extend: agewallet_auto_metadata (array, before encoding) and agewallet_metadata (final string, after encoding). Read back with agewallet_get_metadata().
• Feature: WooCommerce checkout gating. New three-state Checkout Gating control on the Content Guarding page (visible only when WooCommerce is active): Off (no checkout-specific rule), Force Always (every checkout gates), or Conditional on Cart (gate fires only when the cart contains items flagged as regulated). Regulated status is set per-product via a new "AgeWallet" tab in the product data metabox (Not Regulated / Regulated / Override) or per-category and per-tag via a Regulated checkbox on the term edit screens. Per-checkout cart context (cart hash, total, currency, line item count, billing country) is composed into the verification metadata and merged with any site-level metadata. When Conditional on Cart mode fires the gate, a cart_triggers audit field captures the product, category, and tag IDs that triggered. Filters: agewallet_wc_checkout_metadata, agewallet_cart_has_regulated_items, agewallet_regulated_cart_triggers.
• Safety: Strict-mode cache automatically skips WooCommerce checkout, cart, and my-account pages. Caching cart-bearing pages would either render an empty cart in the cookieless loopback or leak one customer's HTML to another, so these pages always render live.
• Dev: New helper agewallet_get_metadata() and AgeWallet_Helpers::get_verified_cookie_payload(). Cart-inspection methods exposed on AgeWallet_WooCommerce: checkout_gating_mode, cart_contains_regulated_items, get_regulated_triggers, product_is_regulated. Programmatic flagging via post meta (_agewallet_regulated_status on products) and term meta (agewallet_regulated on product_cat and product_tag).

1.3.1

• Fix: On verification failure, redirect user back to originating page so the age gate re-triggers, rather than showing a misleading "cancelled or denied" message.

1.3.0

• Architecture: Implemented High Security (Strict) Mode with API-based content retrieval.
• Architecture: Added Split-Cache system (Singular/Archive) for intelligent invalidation.
• Compatibility: Switched verification triggers to POST requests to bypass aggressive host caching (WP Engine, etc).
• UX: Refactored Admin Settings into a multi-step Wizard.
• Feature: Added Manual Cache Purge tool.
• Security: Implemented HMAC cryptographic signing for verification cookies to prevent forgery.
• Feature: Added granular Taxonomy Gating (support for Categories, Tags, and Custom Taxonomies).
• Feature: Added "Cache Control" settings with configurable auto-purge schedule (WP-Cron).
• Feature: Extended automatic cache invalidation to include Menu, Theme, and Term updates.
• Dev: Added multiple new hooks for deep customization of cookies, caching, and taxonomy rules.

1.2.0

• Patched 2 bugs preventing shortcode from working properly in some environments.

1.0.1

• CSS and Documentation tweaks.

1.0.0

• Feature: Added an in-dashboard "Plugin Guide" page that displays the plugin's readme file.

0.1.7

• Tweak: Standardized all front-end CSS class names for better consistency and to prevent theme conflicts.
• Tweak: Converted the "I Agree" link into a <button> element for better styling compatibility across themes.
• Feature: Added numerous developer hooks and filters for improved extensibility.
• Security: Hardened client-side script by adding click handlers dynamically instead of using inline attributes.