VerifyBlind Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
VerifyBlind lets visitors prove an age condition (for example 18+, 21+, 16-18 or 65+) or that they are one person with one account, with their chipped Turkish ID card and the VerifyBlind mobile app. The card is read on the visitor’s phone and matched to a live face check in a sealed environment (an AWS Nitro Enclave). Your site receives only an eligible / not eligible answer and, for the one-person check, a pseudonymous code issued for your site only. Names, ID numbers, birth dates and photos never reach your site.
Rules decide where a verification is asked and what is asked:
- Where: sign-up (WordPress and WooCommerce), pages, posts and categories (or the “VerifyBlind lock” block and the
[verifyblind_gate]shortcode anywhere), comments, WooCommerce checkout, product pages, the whole shop entrance, coupons, product reviews, or only a role for another plugin. - What: an age condition (at least N, younger than N, or a range) and/or the one-person check.
- Same person on another account: reject the verification, block the action, accept and notify you, or move the verification to the new account.
- For those who pass: an optional extra role (next to their existing role) and a validity period.
Every gate is enforced on the server: locked text is removed before the page is sent, and orders, coupons, sign-ups and comments are refused on the server when the check is missing.
Also included: a setup wizard with ready-made rules, a “Verified with VerifyBlind” badge for comments, reviews and author boxes, a “Verified members” screen, the WordPress personal data export and erase tools, a suggested privacy policy paragraph, a revoke address that removes a result when the person withdraws consent in the VerifyBlind app, and Turkish and English translations.
Cost: each requested item counts as one verification (age = 1, one-person check = 1). 2,000 verifications a month are free.
External services
This plugin connects your site to VerifyBlind (https://verifyblind.com), the service that performs the verification. It cannot work without it. This is everything that is sent, where, and when.
From your site’s server to the VerifyBlind API (https://api.verifyblind.com):
- When a visitor presses “Verify with VerifyBlind”:
POST /api/pop/generatewith your site’s API key, a one-time public key created in the visitor’s browser for this verification, the conditions the rule asks for (for example age 18+ and/or the one-person check), the widget version, the language the visitor’s browser asks for (the Accept-Language header), and the plugin version (headerX-VerifyBlind-Client: wordpress/1.0.4). No name, e-mail address or IP address of the visitor is sent. - When you test the connection (setup wizard or Settings): the same call with VerifyBlind’s own public key and an age 18+ condition. The session is never used and not billed.
- When a verification result arrives:
GET /api/public/enclave-key(VerifyBlind’s public key, kept for about a minute) to check the result’s signature on your server. - When VerifyBlind calls your revoke address:
GET /api/public/webhook-signing-key(kept for an hour) to check that the call really comes from VerifyBlind.
From the visitor’s browser, only on pages that show a verification box:
- The VerifyBlind widget https://cdn.verifyblind.com/sdk/v1.0.2/verifyblind.js (a fixed version, checked with a Subresource Integrity hash). The widget in turn loads its QR code library https://cdn.verifyblind.com/sdk/v1.0.2/vendor/qr-code-styling.min.js and logo https://cdn.verifyblind.com/images/qrlogo.png.
- While the QR code is on screen, the browser asks https://api.verifyblind.com/api/pop/result/ (followed by the session code) every two seconds for the result, which is encrypted for that browser only. Like any web request, this shows VerifyBlind the visitor’s IP address; VerifyBlind does not pass it to your site.
- The QR code holds a link to https://app.verifyblind.com that the visitor opens with the VerifyBlind app on their phone.
From VerifyBlind to your site: when a person withdraws consent in the VerifyBlind app, VerifyBlind sends a signed POST to your revoke address (/wp-json/verifyblind/v1/revoke) with the session code, and the plugin deletes the results tied to it.
VerifyBlind terms of service: https://verifyblind.com/en/terms
VerifyBlind privacy policy: https://verifyblind.com/en/privacy
VerifyBlind data processing terms: https://verifyblind.com/en/dpa
The badge images ship with the plugin; readers’ browsers never fetch them from VerifyBlind. The VerifyBlind enclave and mobile apps are published as public source code (review-only licence); the SDKs are open source and this plugin is GPL.
Screenshots
Setup wizard: choose what kind of site this is; the wizard adds ready-made rules.
Rules: where a verification is asked, what is asked and what happens when the same person comes back with another account.
Rule editor.
The verification box on a locked page.
Verified members.
