WordPress KYC Plugin: WooCommerce Age Check

Add Didit identity verification and age gating to any WordPress site or WooCommerce store. The plugin works as a secure backend proxy — your API key stays on the server — and exposes shortcodes, a WooCommerce checkout gate, and developer hooks so you can drop verification in without writing JavaScript.

Prerequisites

WordPress 6.0 or higher
PHP 7.4 or higher
A Didit Console account

Step 1: Get your Didit credentials

Sign up or log in at business.didit.me
Go to API & Webhooks and copy your API Key
Go to Workflows, create or select a workflow, and copy the Workflow ID

You can use a UniLink URL to preview the verification flow without API keys. Use API Session mode with an API key and workflow ID for content gates and WooCommerce verification requirements. UniLink completion alone does not unlock protected content or approve an order.

Step 2: Install the plugin

Download didit-verify-0.3.4.zip from the 0.3.4 release
In your WordPress admin, go to Plugins → Add New → Upload Plugin
Choose the downloaded ZIP file and click Install Now
Click Activate

Didit Verify is also listed on WordPress.org. Check the version before installing: use 0.3.4 or later for the server-confirmed verification behavior described here. From 0.3.4, access to protected content is revoked when an approved verification is later declined, expires or goes back to review. If the directory has an older version, install the release ZIP above.

After upgrading from a version older than 0.3.2, users whose earlier approval was not confirmed by the server must verify again before accessing protected content or completing a verification-required checkout.

Step 3: Configure the plugin

Go to Settings → Didit Verify.

Choose your mode

Mode	Best for	What you need
UniLink	Quick testing	Just the UniLink URL from your workflow
API Session (recommended)	Production use	Workflow ID + API Key

For UniLink: Set Mode to “UniLink”, paste your URL, and save. For API Session: Set Mode to “API Session”, enter your Workflow ID and API Key, and save.

The API key is stored securely on your server and never exposed to visitors.

Configure session options (API mode only)

These are optional settings that give you more control:

Vendor Data — Links each verification to a specific user in your Didit dashboard, so you can track who verified. Default is WordPress User ID (e.g. wp-42). You can also choose User Email, a custom prefix, or disable it.
Callback URL — A page on your site where users are redirected after verification. Didit appends verificationSessionId and status as query parameters.
Callback Method — Which device handles the redirect: initiator (the device that started), completer (the device that finishes), or both.
Language — Choose from 54 languages or let it auto-detect from the browser.

Configure display options

Display Mode — Modal (popup overlay) or Embedded (inline on the page)
Close Button — Show or hide the X button on the modal
Exit Confirmation — Show an “Are you sure?” dialog when closing
Auto-close — Automatically close the modal when verification completes
Debug Logging — Log SDK events to the browser console (for troubleshooting)

Customize the button

Under Button Appearance, you can change:

Button text and success text
Background color and text color
Border radius, padding, and font size

A live preview updates in real time as you change values.

Step 4: Add verification to your site

For WooCommerce stores

In Settings → Didit Verify → WooCommerce, check Require identity verification at checkout
Choose where the verification section appears:
- Top of checkout page
- After billing details
- After order notes
- Before “Place Order” (recommended)
Optionally choose a Product Scope: all products (the default), only selected products, or all products except selected ones. Mark products with the Didit verification checkbox under Product data → Advanced in the product editor. A cart that holds at least one product that needs verification requires it. The scope applies to both checkout and after-purchase modes.
Optionally edit the Section Title, Checkout Message and Post-purchase Message under Settings → Didit Verify → WooCommerce; empty fields use the default text
Optionally enable Send Billing Data to auto-send the customer’s name, email, phone, and address to Didit for pre-filling and cross-validation

Country codes are automatically converted from WooCommerce’s alpha-2 format to Didit’s required alpha-3 format.

Customers must receive an Approved decision confirmed by the server before they can place an order. This applies to both classic and block checkout. The plugin checks that the session belongs to the current shopper and has not already been used for another order. The session ID is saved to the order for reference. If you choose After purchase, the order stays on hold until the server confirms approval. Guest customers can verify from the order page using its valid order key. Configure the webhook URL and secret shown in Settings → Didit Verify so signed status updates can release approved orders.

For any WordPress page

Add this shortcode to any page or post:

[didit_verify]

A verification button will appear, styled with your Button Appearance settings. You can override the text per page:

[didit_verify text="Verify Now" success_text="Done!"]

Or force embedded mode on a specific page:

[didit_verify mode="embedded"]

Step 5: Restrict content to verified users (optional)

Show or hide content based on verification status: Content gates require a logged-in user and an approval confirmed through API Session mode. Browser callbacks and redirect query parameters do not grant access.

[didit_gate]
This content is only visible to verified users.
[/didit_gate]

Unverified users see a message and a verification button. You can customize the message:

[didit_gate message="Please verify to continue."]Secret content here.[/didit_gate]

Show the user’s verification status anywhere:

[didit_status]

Displays “Identity Verified” or “Not Verified” for the logged-in user.

Checking verification status

Where	How
Admin panel	Users → All Users — a “Didit” column shows ✓ for verified users
WooCommerce orders	The Didit session ID appears in the order details
Shortcode	`[didit_status]` displays the status on any page

Troubleshooting

Issue	Solution
”Creating session…” hangs	Check that your Workflow ID and API Key are correct in Settings → Didit Verify
Modal doesn’t open	Make sure the page contains `[didit_verify]` or WooCommerce checkout verification is enabled
Verification UI in wrong language	Change the Language setting in Session Options
Need to debug	Enable Debug Logging in Display Options, then open the browser console (F12) to see SDK events

Security

The plugin acts as a secure backend proxy. Your API key never reaches the browser. Every session request is protected by:

CSRF nonce — requests must originate from your WordPress site
Login requirement — only registered users can create sessions (configurable)
Rate limiting — 10 sessions/hour per user, 3/hour per IP for guests
Input sanitization — all fields are whitelisted and sanitized server-side

Session creation binds verification to the current shopper or order. The plugin confirms decisions with the Didit API or a verified webhook before marking a user or order approved. Guest checkout can create a session when verification is required, even if the general login requirement is enabled. After-purchase verification also requires a valid order key.

For developers

PHP hooks

The plugin fires WordPress actions that other plugins or themes can hook into:

// When a user completes verification
add_action('didit_verification_completed', function ($user_id, $session_id, $status) {
    // Update CRM, send email, grant access, etc.
}, 10, 3);

// When a user cancels verification
add_action('didit_verification_cancelled', function ($user_id, $session_id) {
    // Log cancellation
}, 10, 2);

// When a session is created server-side
add_action('didit_session_created', function ($url, $user_id, $vendor_data) {
    // Log, notify, etc.
}, 10, 3);

JavaScript event

A DOM event is dispatched when verification finishes:

document.addEventListener('didit:complete', function (e) {
    console.log('Result:', e.detail); // { type, session }
});

Check verification in PHP

$is_verified = Didit_Verify::init()->is_user_verified($user_id);

Use this helper to include the server-confirmation check. Do not grant access from legacy user metadata or the browser’s didit:complete event alone.

Guides

Authentication

Model Context Protocol (MCP)

Web SDKs

Native SDKs

Server SDKs

Integrations

WordPress KYC Plugin: WooCommerce Age Check

Prerequisites

Step 1: Get your Didit credentials

Step 2: Install the plugin

Step 3: Configure the plugin

Choose your mode

Configure session options (API mode only)

Configure display options

Customize the button

Step 4: Add verification to your site

For WooCommerce stores

For any WordPress page

Step 5: Restrict content to verified users (optional)

Checking verification status

Troubleshooting

Security

For developers

PHP hooks

JavaScript event

Check verification in PHP

Resources