內容簡介
VerifyBlind 外掛讓訪客能夠透過土耳其身份證和 VerifyBlind 行動應用程式，證明年齡條件或確認單一帳戶的身份。此外掛確保網站僅接收合格或不合格的回應，並保護用戶隱私。
【主要功能】
• 支援年齡驗證及單一身份檢查
• 伺服器端強制執行驗證規則
• 提供設置精靈和現成規則
• 可選擇額外角色及有效期
• 附有「Verified with VerifyBlind」徽章
• 連接 VerifyBlind 進行驗證
外掛標籤
開發者團隊
原文外掛簡介
VerifyBlind lets visitors prove an age condition (for example 18+, 21+, 16-18 or 65+) or that they are one person with one account, with their chipped Turkish ID card and the VerifyBlind mobile app. The card is read on the visitor’s phone and matched to a live face check in a sealed environment (an AWS Nitro Enclave). Your site receives only an eligible / not eligible answer and, for the one-person check, a pseudonymous code issued for your site only. Names, ID numbers, birth dates and photos never reach your site.
Rules decide where a verification is asked and what is asked:
Where: sign-up (WordPress and WooCommerce), pages, posts and categories (or the “VerifyBlind lock” block and the [verifyblind_gate] shortcode anywhere), comments, WooCommerce checkout, product pages, the whole shop entrance, coupons, product reviews, or only a role for another plugin.
What: an age condition (at least N, younger than N, or a range) and/or the one-person check.
Same person on another account: reject the verification, block the action, accept and notify you, or move the verification to the new account.
For those who pass: an optional extra role (next to their existing role) and a validity period.
Every gate is enforced on the server: locked text is removed before the page is sent, and orders, coupons, sign-ups and comments are refused on the server when the check is missing.
Also included: a setup wizard with ready-made rules, a “Verified with VerifyBlind” badge for comments, reviews and author boxes, a “Verified members” screen, the WordPress personal data export and erase tools, a suggested privacy policy paragraph, a revoke address that removes a result when the person withdraws consent in the VerifyBlind app, and Turkish and English translations.
Cost: each requested item counts as one verification (age = 1, one-person check = 1). 2,000 verifications a month are free.
External services
This plugin connects your site to VerifyBlind (https://verifyblind.com), the service that performs the verification. It cannot work without it. This is everything that is sent, where, and when.
From your site’s server to the VerifyBlind API (https://api.verifyblind.com):
When a visitor presses “Verify with VerifyBlind”: POST /api/pop/generate with your site’s API key, a one-time public key created in the visitor’s browser for this verification, the conditions the rule asks for (for example age 18+ and/or the one-person check), the widget version, the language the visitor’s browser asks for (the Accept-Language header), and the plugin version (header X-VerifyBlind-Client: wordpress/1.0.5). No name, e-mail address or IP address of the visitor is sent.
When you test the connection (setup wizard or Settings): the same call with VerifyBlind’s own public key and an age 18+ condition. The session is never used and not billed.
When a verification result arrives: GET /api/public/enclave-key (VerifyBlind’s public key, kept for about a minute) to check the result’s signature on your server.
When VerifyBlind calls your revoke address: GET /api/public/webhook-signing-key (kept for an hour) to check that the call really comes from VerifyBlind.
From the visitor’s browser, only on pages that show a verification box:
The VerifyBlind widget https://cdn.verifyblind.com/sdk/v1.0.2/verifyblind.js (a fixed version, checked with a Subresource Integrity hash). The widget in turn loads its QR code library https://cdn.verifyblind.com/sdk/v1.0.2/vendor/qr-code-styling.min.js and logo https://cdn.verifyblind.com/images/qrlogo.png.
While the QR code is on screen, the browser asks https://api.verifyblind.com/api/pop/result/ (followed by the session code) every two seconds for the result, which is encrypted for that browser only. Like any web request, this shows VerifyBlind the visitor’s IP address; VerifyBlind does not pass it to your site.
The QR code holds a link to https://app.verifyblind.com that the visitor opens with the VerifyBlind app on their phone.
From VerifyBlind to your site: when a person withdraws consent in the VerifyBlind app, VerifyBlind sends a signed POST to your revoke address (/wp-json/verifyblind/v1/revoke) with the session code, and the plugin deletes the results tied to it.
VerifyBlind terms of service: https://verifyblind.com/en/terms
VerifyBlind privacy policy: https://verifyblind.com/en/privacy
VerifyBlind data processing terms: https://verifyblind.com/en/dpa
The badge images ship with the plugin; readers’ browsers never fetch them from VerifyBlind. The VerifyBlind enclave and mobile apps are published as public source code (review-only licence); the SDKs are open source and this plugin is GPL.
