How to Set Up WooCommerce Age Verification
If your WooCommerce store sells age-restricted products, a date-of-birth field or an “I am 18” checkbox is not a meaningful age check. The new OneGuard for WooCommerce plugin connects individual products to a guided verification flow, keeps affected orders on hold while verification is pending, and updates the order automatically after a successful result.
This lets you add age checks to the existing order journey without putting a blanket age gate in front of your entire storefront. This guide explains how the workflow operates, what data is processed, and what to test before you go live.
Why WooCommerce stores need reliable age verification
Tobacco and vaping products, alcoholic drinks, certain media, and other restricted goods must not be supplied to customers who are below the applicable age. The exact obligation depends on the product, the customer’s jurisdiction, and the way the order is delivered.
A self-declared date of birth does not establish whether the age is accurate or whether the person placing the order belongs to the information provided. A technical age-verification step gives merchants a traceable control within the order workflow. Three requirements matter in particular:
- Targeted checks: Verification should run only when the basket contains a product that needs it.
- Clear order handling: An unverified order must not accidentally move into fulfilment.
- Privacy-aware processing: Sensitive checks should remain outside the normal WordPress media library and order interface.
OneGuard is designed around those requirements. For more background on the available methods, read our overview of identity and age verification.
What the new OneGuard plugin adds to WooCommerce
The plugin adds product-level controls to WooCommerce and connects the store to the external OneGuard verification service.
| Feature | What it does for your store |
|---|---|
| Verification per product | Only orders containing products marked as restricted trigger a verification. |
| Individual minimum ages | Each restricted product can have its own required age or use the global default. |
| Automatic order hold | Affected paid orders remain on hold while verification is pending. |
| Guided verification | Customers are sent directly to the OneGuard verification flow after checkout. |
| Automatic result update | After a successful result, OneGuard returns the status and the plugin updates the WooCommerce order. |
| German and English | The admin interface, customer messages, and verification flow use an appropriate language. |
| HPOS support | The plugin declares compatibility with WooCommerce High-Performance Order Storage. |
The current WordPress.org launch release uses a free OneGuard plan. It does not collect payment details in WordPress and, according to the plugin listing, the launch plan has no monthly or per-verification fee.
How age verification works after checkout
Orders containing only unrestricted products continue through the normal store flow. When an affected paid order includes a product configured for age verification, the OneGuard workflow begins:
- Connect the plugin: Open
WooCommerce > Oneguard, activate the free OneGuard plan, and connect the store. - Mark restricted products: Enable age verification in the product editor and set the required minimum age.
- Use the normal checkout: The customer completes the regular WooCommerce checkout.
- Hold the order: The affected order remains on hold while no successful verification result is available.
- Verify the customer: A guided OneGuard flow takes the customer through the required check.
- Return the result: OneGuard sends the result back and the plugin updates the WooCommerce order automatically.
The decision therefore remains linked to the relevant order. The WordPress dashboard shows the current store connection, plan, and verification status without requiring staff to handle document images inside WooCommerce.
Product-level rules instead of a blanket storefront gate
Many stores sell a mix of unrestricted and age-restricted items. Putting an 18+ landing page in front of the whole store adds friction for every visitor and still does not prove the age of the person who eventually places an order.
OneGuard lets you mark restricted products individually. A global default age makes the initial configuration faster, while a product can store its own minimum age when needed. The settings screen also lists products that already have age verification enabled.
Before enabling the workflow, review your catalogue systematically:
- Which products are subject to an age restriction?
- Do all restricted products use the same threshold?
- Which countries or regions do you ship to, and what rules apply there?
- Does the carrier need to perform an additional check at handover?
You can explore common use cases on our industry pages for vape and tobacco stores and alcohol and spirits merchants.
What happens while verification is pending
Age verification is useful only when its result actually controls fulfilment. The plugin therefore keeps an affected paid order on hold while verification remains pending. When OneGuard returns a successful result, the plugin updates the order automatically.
Your operating procedure should support that technical control:
- Do not pick, pack, or dispatch an order that is still on hold for verification.
- Check the verification state before making a manual order-status change.
- Test how warehouse, fulfilment, email, and accounting integrations react to the hold state.
- Define a documented process for incomplete, expired, or unsuccessful checks.
The public plugin listing does not promise automatic cancellation. If your store uses separate cancellation or reminder automations, test them independently.
Privacy: what WordPress stores—and what it does not
Document analysis and face checks do not run inside WordPress. They are handled by the external OneGuard service, keeping particularly sensitive raw assets out of the WordPress media library and local upload folders.
WordPress does not store:
- identity-document images
- face images or selfie videos
- biometric raw data
- OCR raw data
- full names or addresses extracted from the identity document
WordPress does store selected technical status, order, and result data. This can include the verification ID and status, required age, expiry date, order and customer IDs, customer email, cart hash, and the restricted products purchased. After a successful verification, selected returned fields can also include the document number, document type, date of birth, and calculated age.
To perform a verification, the plugin sends the required store, order, and customer information to the OneGuard services. Depending on the request, this includes details such as the site domain and software versions, plus the order number, customer name, email, billing-address text, locale, required age, and restricted-product metadata. The external connection is activated only after the store operator enables the free plan in the plugin settings.
Records in the plugin’s custom verification table remain there until the plugin is uninstalled; uninstalling removes that table. Verification metadata attached to WooCommerce orders follows the store’s normal order-retention and deletion process. Account for this processing in your privacy notice, retention policy, and any required processor agreements. More detail is available in the OneGuard privacy policy (German) and the WordPress.org plugin listing.
Securing result callbacks to WooCommerce
The store connection uses per-shop HMAC signatures so an arbitrary request cannot simply change an order’s verification state. Callbacks to WooCommerce also include a timestamp and nonce. According to the plugin’s technical description, it rejects stale timestamps, reused nonces, invalid signatures, and callbacks intended for a different shop.
The shop secret is stored in WordPress options but is not displayed in clear text in the admin interface. As with any security-sensitive integration, keep WordPress, WooCommerce, and the plugin updated and protect administrator accounts appropriately.
German and English customer journeys
The store operator can select German or English in the plugin settings. That choice is used in the admin area and as the customer-facing fallback when the customer’s country cannot be detected.
When a billing country is available, customers in Germany, Austria, Switzerland, Liechtenstein, and Luxembourg receive German messages. Other detected countries receive English messages. The same locale is passed to the OneGuard verification flow, keeping the transition from checkout to verification consistent.
Install and test the plugin in six steps
- Confirm that the store meets the requirements shown in the plugin listing: WordPress 6.2 or newer, PHP 8.0 or newer, and an active WooCommerce installation.
- Install Oneguard for WooCommerce from the WordPress plugin directory and activate it.
- Open
WooCommerce > Oneguardand activate the free launch plan. - Configure the default language, global minimum age, and other verification settings.
- Enable age verification on each relevant WooCommerce product and review its minimum age.
- Place a complete test order containing a restricted product. Check the handoff, order hold, successful callback, and behaviour of every connected system.
The plugin supports WooCommerce HPOS. A staging test is still sensible before production use, especially when your store has a customised checkout, external fulfilment, or other extensions that update order statuses automatically.
Compliance: a technical tool, not a universal guarantee
OneGuard supplies the technical verification workflow and connects its result to the WooCommerce order. That does not create a blanket guarantee that every store complies with every rule in every market.
Requirements vary by product, country, state, customer location, and delivery method. Some regimes or product categories may require a further age or identity check when the parcel is handed over. The plugin controls the post-checkout order workflow; it does not replace the merchant’s assessment of delivery restrictions or carrier obligations.
Before launch, confirm with qualified legal advisers and your delivery providers:
- the applicable age threshold for each product and destination,
- where in the purchase and delivery journey checks must occur,
- which evidence may or must be retained,
- whether personal handover or an additional delivery check is required.
Frequently asked questions
Do I have to enable verification for the entire store?
No. Verification can be enabled per WooCommerce product, so unrestricted products do not need to trigger the flow.
What happens while a verification is open?
An affected paid order remains on hold. After a successful result, the plugin updates the WooCommerce order automatically.
Is OneGuard for WooCommerce free?
The current WordPress.org launch release activates a free OneGuard plan with no monthly or per-verification fee. It does not collect payment details in WordPress. Future offerings can change, so the current plugin listing remains authoritative.
Are identity-document or selfie images stored in WordPress?
No. WordPress does not store document images, face images, selfie videos, biometric raw data, or OCR raw data. It does retain selected status, order, and result metadata.
Does the plugin support WooCommerce HPOS?
Yes. OneGuard for WooCommerce declares compatibility with WooCommerce High-Performance Order Storage.
Does online verification replace an age check on delivery?
There is no universal answer. The required controls depend on the product, destination, and delivery method. Some orders may still need a carrier-performed age or identity check at handover.
What should I test before launch?
Test at least one unrestricted product, one restricted product, a successful verification, and a pending or abandoned flow. Also inspect emails, fulfilment exports, and every automation that reacts to WooCommerce order statuses.
Connect age verification directly to WooCommerce
OneGuard for WooCommerce links product-level age rules to a traceable order workflow: customers use the normal checkout, affected orders remain on hold until a successful result is available, and WooCommerce is updated automatically. At the same time, document images, selfie videos, and biometric raw data stay outside WordPress.
Ready to add age verification to your store?
Install OneGuard free from WordPress.org or explore the WooCommerce integration.