{"id":282721,"date":"2026-03-18T15:14:49","date_gmt":"2026-03-18T15:14:49","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/borderage-core\/"},"modified":"2026-03-18T15:14:19","modified_gmt":"2026-03-18T15:14:19","slug":"borderage-core","status":"publish","type":"plugin","link":"https:\/\/azb.wordpress.org\/plugins\/borderage-core\/","author":23439313,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_crdt_document":"","version":"0.1.0","stable_tag":"trunk","tested":"6.9.4","requires":"6.2","requires_php":"8.1","requires_plugins":null,"header_name":"Borderage Core","header_author":"Needemand","header_description":"Prot\u00e9gez vos pages ou l'ensemble de votre site WordPress en v\u00e9rifiant l'\u00e2ge des visiteurs via l'API Borderage.","assets_banners_color":"","last_updated":"2026-03-18 15:14:19","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":145,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"brekam","date":"2026-03-18 15:16:25"}},"upgrade_notice":{"0.1.0":"<p>Initial release. No previous versions to upgrade from.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3485986,"resolution":"128x128","location":"assets","locale":""},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3485986,"resolution":"256x256","location":"assets","locale":""},"icon.svg":{"filename":"icon.svg","revision":3485986,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[],"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[20012,70877,5616,14361,258046],"plugin_category":[],"plugin_contributors":[],"plugin_business_model":[],"class_list":["post-282721","plugin","type-plugin","status-publish","hentry","plugin_tags-adult-content","plugin_tags-age-gate","plugin_tags-age-verification","plugin_tags-compliance","plugin_tags-hand-gesture","plugin_committers-brekam"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/borderage-core\/assets\/icon.svg?rev=3485986","icon":"https:\/\/ps.w.org\/borderage-core\/assets\/icon.svg?rev=3485986","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Borderage Core protects your WordPress site by requiring age verification for visitors. Unlike traditional ID-based systems, BorderAge uses <strong>hand gesture recognition<\/strong> - no selfie, no ID document required.<\/p>\n\n<p><strong>Features:<\/strong><\/p>\n\n<ul>\n<li>Protect entire site or specific pages<\/li>\n<li>Hand gesture verification (no facial recognition)<\/li>\n<li>Visitor account system for returning users<\/li>\n<li>Unified login form (WordPress account first, then visitor account fallback)<\/li>\n<li>Credit alert system - Automatic email notifications when credits run low<\/li>\n<li>Rate limiting - Prevent brute force verification attempts<\/li>\n<li>Login brute-force protection - Rate limiting on account login attempts<\/li>\n<li>Health logging system - 24-hour internal monitoring with export<\/li>\n<li>Statistics dashboard - View verification metrics (total, adults, minors)<\/li>\n<li>Customizable verification page styling<\/li>\n<li>Multi-language support (EN, FR, DE, ES)<\/li>\n<li>Developer tools - Testing utilities and data reset<\/li>\n<li>Debug mode with logging and export functionality<\/li>\n<\/ul>\n\n<p><strong>Requirements:<\/strong><\/p>\n\n<ul>\n<li>BorderAge API credentials (site_id and site_secret_key)<\/li>\n<li>Credits for new verifications (existing verified users can still access)<\/li>\n<li>Pretty permalinks enabled in WordPress Settings<\/li>\n<\/ul>\n\n<p>For more information, visit <a href=\"https:\/\/borderage.com\/\">borderage.com<\/a> or contact us at <a href=\"contact@needemand.com\">contact@needemand.com<\/a><\/p>\n\n<h3>Admin Pages<\/h3>\n\n<p>Borderage Core provides 8 configuration tabs accessible via <strong>BorderAge<\/strong> in the WordPress admin menu:<\/p>\n\n\n\n\n  Tab\n  Description\n  Purpose\n\n\n\n\n  Configuration\n  API credentials and basic settings\n  Enter your site_id, secret_key, enable\/disable plugin, set debug mode\n\n\n  Protection\n  Protection mode and protected pages\n  Choose to protect all pages or specific pages, configure rate limiting\n\n\n  Appearance\n  Form styling customization\n  Customize verification page colors, button styles, and layout\n\n\n  Statistics\n  Verification metrics dashboard\n  View total verifications, adult\/minor breakdown, monthly statistics\n\n\n  Guide\n  User documentation\n  Complete usage guide and setup instructions\n\n\n  Developers\n  API documentation\n  Technical reference for developers integrating with BorderAge\n\n\n  Debug\n  Health logs viewer\n  View system health logs, export debug information\n\n\n  Dev Tools\n  Testing utilities\n  Reset visitor data, clear logs, testing functions (debug mode only)\n\n\n\n\n<p><strong>Navigation:<\/strong> Click on the \"Borderage\" menu item in WordPress admin to access all tabs. Each tab provides a specific set of configuration options and tools.<\/p>\n\n<h3>External Services<\/h3>\n\n<p>This plugin connects to the <strong>BorderAge API<\/strong> at <code>pool.borderage.com<\/code> for age verification services.<\/p>\n\n<h4>When data is transmitted<\/h4>\n\n<ol>\n<li><strong>During age verification<\/strong> - When a visitor clicks \"Verify now\"<\/li>\n<li><strong>Credit balance check<\/strong> - When admin pages load to display remaining credits<\/li>\n<li><strong>Statistics retrieval<\/strong> - When the Statistics dashboard loads to display verification metrics<\/li>\n<li><strong>Health logging<\/strong> - Internal monitoring events (not transmitted to external API)<\/li>\n<\/ol>\n\n<h4>Data transmitted<\/h4>\n\n\n\n\n  Data\n  Description\n  Purpose\n\n\n\n\n  site_id\n  Your site identifier\n  Identify your site\n\n\n  user_id\n  SHA256 hashed visitor ID\n  Pseudonymized visitor tracking\n\n\n  age\n  Age threshold\n  Verification requirement\n\n\n  hash\n  Security signature\n  Request validation\n\n\n  is_over_age\n  Boolean (true\/false)\n  Age verification result\n\n\n  result_hash\n  Callback validation hash\n  Verify callback authenticity\n\n\n  reference_id\n  Attempt reference for rate limiting\n  Track verification attempts\n\n\n\n\n<p><strong>Hash Generation:<\/strong><\/p>\n\n<ul>\n<li>Credits check: <code>hash('sha256', timestamp . site_id . secret_key)<\/code><\/li>\n<li>Callback verification: <code>hash('sha1', result . user_id . age . secret_key)<\/code><\/li>\n<\/ul>\n\n<p><strong>Privacy note:<\/strong> This plugin and the BorderAge API store only pseudonymized data: a hashed visitor ID and a boolean indicating whether the age threshold was met. <strong>Zero Personally Identifiable Information (PII)<\/strong> is stored or transmitted - no names, emails. Unlike competitors, BorderAge uses <strong>no biometric fingerprinting<\/strong>, <strong>no selfies<\/strong>, and <strong>no ID documents<\/strong>. This eliminates any risk of personal data leaks, as such data simply doesn't exist in our system.<\/p>\n\n<p>For more details about BorderAge's technology and privacy-first approach, visit <a href=\"https:\/\/borderage.com\/technology\/\">https:\/\/borderage.com\/technology\/<\/a><\/p>\n\n<h4>Service links<\/h4>\n\n<ul>\n<li><strong>Privacy Policy:<\/strong> <a href=\"https:\/\/borderage.com\/politique-confidentialite\/\">https:\/\/borderage.com\/politique-confidentialite\/<\/a><\/li>\n<li><strong>Technology information:<\/strong> <a href=\"https:\/\/borderage.com\/technology\/\">https:\/\/borderage.com\/technology\/<\/a><\/li>\n<li><strong>Service website:<\/strong> <a href=\"https:\/\/borderage.com\/\">https:\/\/borderage.com\/<\/a><\/li>\n<\/ul>\n\n<p><strong>Terms of Service:<\/strong> BorderAge's Terms of Use are negotiated individually between each client and Needemand (creator of the BorderAge SaaS). Contracts are established on a case-by-case basis rather than using a generic public ToS. Please contact BorderAge to discuss your specific terms.<\/p>\n\n<h3>Privacy Policy<\/h3>\n\n<p><strong>Data processed by this plugin:<\/strong><\/p>\n\n<ol>\n<li><strong>Visitor verification status<\/strong> - Stored in browser cookies to remember verified visitors (expires after 24 hours)<\/li>\n<li><strong>Visitor accounts<\/strong> - Optional accounts for returning visitors (email, hashed password)<\/li>\n<li><strong>Verification logs<\/strong> - Records of verification callbacks for debugging (24-hour retention)<\/li>\n<li><strong>Health logs<\/strong> - Internal system monitoring logs (24-hour retention, JSON format)<\/li>\n<\/ol>\n\n<p><strong>Data sent to the external BorderAge API:<\/strong><\/p>\n\n<p>Only pseudonymized data is transmitted and stored: a hashed visitor ID (SHA256) and a boolean indicating whether the age verification was successful (is_over_age: true\/false). Additional metadata includes site_id, age threshold, and security hashes for validation.<\/p>\n\n<p><strong>What makes BorderAge different:<\/strong><\/p>\n\n<ul>\n<li><strong>Zero PII storage<\/strong> - Neither this plugin nor the BorderAge API store any Personally Identifiable Information<\/li>\n<li><strong>No biometric fingerprint<\/strong> - No biometric data is collected, stored, or transmitted<\/li>\n<li><strong>No data leak risk<\/strong> - Impossible to leak personal data that doesn't exist<\/li>\n<li><strong>Privacy by design<\/strong> - Hand gesture verification without selfies, ID documents, or facial recognition<\/li>\n<li><strong>Rate limiting protection<\/strong> - Prevents brute force verification attempts<\/li>\n<li><strong>Automatic cleanup<\/strong> - Verification tokens and logs expire after 24 hours<\/li>\n<\/ul>\n\n<p>For complete privacy information, see the <a href=\"https:\/\/borderage.com\/politique-confidentialite\/\">BorderAge Privacy Policy<\/a>.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>borderage-core<\/code> folder to <code>\/wp-content\/plugins\/<\/code><\/li>\n<li>Activate the plugin through the 'Plugins' menu in WordPress<\/li>\n<li><strong>Important:<\/strong> Ensure <strong>Pretty Permalinks<\/strong> are enabled in <strong>Settings &gt; Permalinks<\/strong> (required for verification callback)<\/li>\n<li>Go to <strong>BorderAge &gt; Configuration<\/strong> to enter your API credentials (site_id and site_secret_key)<\/li>\n<li>Navigate to <strong>BorderAge &gt; Protection<\/strong> to enable protection and configure protected pages or entire site<\/li>\n<li>Customize the verification page appearance in <strong>BorderAge &gt; Appearance<\/strong><\/li>\n<li>Optionally configure credit alerts and rate limiting in <strong>BorderAge &gt; Protection<\/strong><\/li>\n<\/ol>\n\n<p>For detailed setup instructions, visit the <strong>Guide<\/strong> tab in the BorderAge admin menu.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"how%20do%20i%20get%20api%20credentials%3F\"><h3>How do I get API credentials?<\/h3><\/dt>\n<dd><p>Contact BorderAge at borderage@needemand.com or visit <a href=\"https:\/\/borderage.com\/\">borderage.com<\/a> to obtain your site_id and site_secret_key.<\/p><\/dd>\n<dt id=\"what%20happens%20when%20credits%20run%20out%3F\"><h3>What happens when credits run out?<\/h3><\/dt>\n<dd><p>Already-verified visitors (with valid cookies) can still access protected pages. New visitors will see the verification page but won't be able to complete verification until credits are replenished. You can configure automatic email alerts in the Protection tab to notify you when credits fall below a threshold (default: 100).<\/p><\/dd>\n<dt id=\"is%20facial%20recognition%20used%3F\"><h3>Is facial recognition used?<\/h3><\/dt>\n<dd><p>No. BorderAge uses hand gesture recognition only. Visitors wave their hand to verify their age - no selfie, no ID document, no facial data.<\/p><\/dd>\n<dt id=\"does%20this%20guarantee%20legal%20compliance%3F\"><h3>Does this guarantee legal compliance?<\/h3><\/dt>\n<dd><p>This plugin is a tool to assist with age verification. Compliance with applicable laws depends on your jurisdiction and implementation. Consult legal counsel for compliance advice.<\/p><\/dd>\n<dt id=\"how%20does%20the%20security%20system%20work%3F\"><h3>How does the security system work?<\/h3><\/dt>\n<dd><p>BorderAge Core includes a multi-layer security system to protect against abuse:<\/p>\n\n<p><strong>Token-Based Protection:<\/strong><\/p>\n\n<ol>\n<li><strong>Token Creation<\/strong> - When a visitor starts verification, a unique one-time token is created in the database<\/li>\n<li><strong>BorderAge Callback<\/strong> - The API returns a callback URL. The plugin validates the token exists and hasn't been used yet<\/li>\n<li><strong>Token Consumption<\/strong> - If valid, the token is marked as used and the visitor can create an account<\/li>\n<li><strong>Expiration<\/strong> - Tokens expire after 5 minutes or 24 hours (for cleanup)<\/li>\n<\/ol>\n\n<p><strong>Rate Limiting:<\/strong><\/p>\n\n<ol>\n<li><strong>Attempt Tracking<\/strong> - Each verification attempt generates a unique reference ID<\/li>\n<li><strong>Configurable Limits<\/strong> - Set max attempts (default: 1) and time window in hours (default: 24)<\/li>\n<li><strong>Enforcement<\/strong> - When limit is exceeded, visitors see a 429 error page<\/li>\n<li><strong>Automatic Cleanup<\/strong> - Old attempts are removed after the time window expires<\/li>\n<\/ol>\n\n<p><strong>Unified Login + Login Rate Limiting:<\/strong><\/p>\n\n<ol>\n<li><strong>Single Login Form<\/strong> - Visitors use one login form from the verification page<\/li>\n<li><strong>Dual Authentication Order<\/strong> - Plugin checks WordPress credentials first, then falls back to visitor account credentials<\/li>\n<li><strong>Login Attempt Tracking<\/strong> - Failed login attempts are rate-limited with anonymized references<\/li>\n<li><strong>Privacy by Design<\/strong> - No IP address is stored in the database for login rate limiting<\/li>\n<\/ol>\n\n<p><strong>Security Benefits:<\/strong><\/p>\n\n<ul>\n<li>Prevents callback URL sharing and account fraud<\/li>\n<li>One-time tokens eliminate reuse attempts<\/li>\n<li>Rate limiting prevents brute force verification attempts<\/li>\n<li>Hash verification ensures callback authenticity<\/li>\n<li>Automatic cleanup prevents stale data<\/li>\n<li>Transparent to users - seamless experience<\/li>\n<li>GDPR\/CNIL compliant - no IP addresses or personal data stored<\/li>\n<\/ul><\/dd>\n<dt id=\"how%20do%20credit%20alerts%20work%3F\"><h3>How do credit alerts work?<\/h3><\/dt>\n<dd><p>The credit alert system automatically notifies you when your BorderAge credit balance falls below a configured threshold:<\/p>\n\n<ul>\n<li><strong>Configuration:<\/strong> Set alert threshold (default: 100 credits) in BorderAge &gt; Protection<\/li>\n<li><strong>Email Setup:<\/strong> Enter your notification email address<\/li>\n<li><strong>Enable\/Disable:<\/strong> Toggle credit alerts on or off<\/li>\n<li><strong>Daily Checks:<\/strong> A cron job checks your balance once per day<\/li>\n<li><strong>Duplicate Prevention:<\/strong> Only one alert sent per low-balance period<\/li>\n<li><strong>Test Email:<\/strong> Send a test email to verify your configuration<\/li>\n<\/ul>\n\n<p>This ensures you never run out of credits unexpectedly, keeping your age verification running smoothly.<\/p><\/dd>\n<dt id=\"what%20is%20rate%20limiting%3F\"><h3>What is rate limiting?<\/h3><\/dt>\n<dd><p>Rate limiting prevents brute force verification attempts by limiting the number of verification attempts a visitor can make within a configured time period:<\/p>\n\n<ul>\n<li><strong>Default Settings:<\/strong> 1 attempt per 24 hours<\/li>\n<li><strong>Customizable:<\/strong> Adjust max attempts and time window in Protection tab<\/li>\n<li><strong>How it Works:<\/strong> Each attempt is tracked by visitor. When limit is exceeded, a 429 error page is displayed<\/li>\n<li><strong>Reference Tracking:<\/strong> Unique reference IDs are generated for failed attempts<\/li>\n<li><strong>Protection:<\/strong> Prevents automated verification attempts and abuse<\/li>\n<\/ul>\n\n<p>The plugin also applies rate limiting to login attempts on the unified login form to reduce brute-force attacks.<\/p>\n\n<p>You can configure rate limits in BorderAge &gt; Protection to match your security needs.<\/p><\/dd>\n<dt id=\"how%20do%20i%20use%20developer%20tools%3F\"><h3>How do I use developer tools?<\/h3><\/dt>\n<dd><p>The Developer Tools tab (BorderAge &gt; Dev Tools) provides testing utilities:<\/p>\n\n<ul>\n<li><strong>Reset Visitor Data:<\/strong> Clear all visitor accounts and verification cookies<\/li>\n<li><strong>Reset Callback Logs:<\/strong> Remove all verification callback records<\/li>\n<li><strong>Clear Health Logs:<\/strong> Delete internal health monitoring logs<\/li>\n<li><strong>Debug Mode Only:<\/strong> These tools are only available when debug mode is enabled<\/li>\n<\/ul>\n\n<p><strong>Caution:<\/strong> These actions permanently delete data. Use with care in production environments. Always backup before resetting data.<\/p><\/dd>\n<dt id=\"how%20do%20i%20debug%20verification%20issues%3F\"><h3>How do I debug verification issues?<\/h3><\/dt>\n<dd><p>Enable Debug Mode in BorderAge &gt; Configuration, then use these tools:<\/p>\n\n<ul>\n<li><strong>Health Logs:<\/strong> View in BorderAge &gt; Debug tab - shows system events and errors<\/li>\n<li><strong>Export Debug Info:<\/strong> Download complete debug dump as JSON<\/li>\n<li><strong>Developer Tools:<\/strong> Reset testing data and clear logs in Dev Tools tab<\/li>\n<li><strong>Callback Logs:<\/strong> View verification callback attempts in database<\/li>\n<li><strong>Health Log Export:<\/strong> Export logs to CSV for analysis<\/li>\n<\/ul>\n\n<p>Log levels include: info, warning, error, api, callback, debug. Logs are retained for 24 hours automatically.<\/p><\/dd>\n<dt id=\"what%20are%20the%20health%20logs%3F\"><h3>What are the health logs?<\/h3><\/dt>\n<dd><p>Health logs provide internal system monitoring for troubleshooting:<\/p>\n\n<ul>\n<li><strong>Location:<\/strong> Stored in protected JSON files with .htaccess<\/li>\n<li><strong>Format:<\/strong> JSON with timestamp, level, message, and context<\/li>\n<li><strong>Log Levels:<\/strong> info, warning, error, api, callback, debug<\/li>\n<li><strong>Retention:<\/strong> Automatically cleaned up after 24 hours<\/li>\n<li><strong>Privacy:<\/strong> Sensitive data is masked in logs<\/li>\n<li><strong>Access:<\/strong> View via BorderAge &gt; Debug tab<\/li>\n<li><strong>Export:<\/strong> Download as JSON or CSV for external analysis<\/li>\n<\/ul>\n\n<p>Health logs help identify API communication issues, verification failures, and system errors.<\/p><\/dd>\n<dt id=\"why%20do%20i%20need%20pretty%20permalinks%3F\"><h3>Why do I need pretty permalinks?<\/h3><\/dt>\n<dd><p>Pretty permalinks are required for the verification callback URL to function correctly:<\/p>\n\n<ul>\n<li><strong>Technical Reason:<\/strong> The callback endpoint requires URL rewriting<\/li>\n<li><strong>Impact:<\/strong> Without pretty permalinks, verification callbacks fail<\/li>\n<li><strong>Setup:<\/strong> Go to Settings &gt; Permalinks, select any option except \"Plain\"<\/li>\n<li><strong>Verification:<\/strong> An admin notice will alert you if permalinks are incompatible<\/li>\n<li><strong>Server Requirement:<\/strong> Requires mod_rewrite on Apache or rewrite rules on Nginx<\/li>\n<\/ul>\n\n<p>The plugin displays an admin notice if pretty permalinks are not enabled, helping you troubleshoot configuration issues.<\/p><\/dd>\n<dt id=\"how%20do%20the%20statistics%20work%3F\"><h3>How do the statistics work?<\/h3><\/dt>\n<dd><p>The Statistics dashboard (BorderAge &gt; Statistics) displays verification metrics:<\/p>\n\n<ul>\n<li><strong>Total Verifications:<\/strong> Count of all completed verifications<\/li>\n<li><strong>Adult\/Minor Breakdown:<\/strong> Number of visitors verified as adults vs minors<\/li>\n<li><strong>Monthly Statistics:<\/strong> Verification trends over time<\/li>\n<li><strong>Data Source:<\/strong> Retrieved from BorderAge API<\/li>\n<li><strong>Caching:<\/strong> Data cached for 10 minutes to reduce API calls<\/li>\n<li><strong>Debug Mode:<\/strong> Displays mock data for testing without API access<\/li>\n<\/ul>\n\n<p>Statistics help you track verification performance and understand your visitor demographics.<\/p><\/dd>\n<dt id=\"what%20is%20the%20visitor%20account%20system%3F\"><h3>What is the visitor account system?<\/h3><\/dt>\n<dd><p>The visitor account system provides a convenient way for returning visitors to avoid repeated verification:<\/p>\n\n<ul>\n<li><strong>Account Creation:<\/strong> Optional after successful verification<\/li>\n<li><strong>Login-based Access:<\/strong> Logged-in visitors bypass verification<\/li>\n<li><strong>Cookie Fallback:<\/strong> Unregistered visitors remembered via cookies (24h)<\/li>\n<li><strong>Credentials:<\/strong> Email and hashed password stored securely<\/li>\n<li><strong>Integration:<\/strong> Works with WordPress user system<\/li>\n<\/ul>\n\n<p>This feature improves user experience for frequent visitors while maintaining security.<\/p><\/dd>\n<dt id=\"why%20does%20the%20plugin%20call%20wp_signon%28%29%20from%20a%20custom%20endpoint%20instead%20of%20a%20custom%20login%3F\"><h3>Why does the plugin call wp_signon() from a custom endpoint instead of a custom login?<\/h3><\/dt>\n<dd><p>The plugin provides one unified login entry point for two account types:\nWordPress users (admins\/editors\/members) and BorderAge visitor accounts.<\/p>\n\n<p>Using <code>wp_signon()<\/code> is technically necessary because WordPress users must be authenticated by WordPress itself, not by plugin-specific password logic.<\/p>\n\n<p>Why this uses WordPress core authentication instead of custom verification:<\/p>\n\n<ul>\n<li><strong>Core password handling<\/strong> - uses WordPress native hashing and authentication flow<\/li>\n<li><strong>Session compatibility<\/strong> - keeps standard WordPress auth cookies and login state<\/li>\n<li><strong>Role and capability continuity<\/strong> - existing WordPress roles are preserved without custom mapping<\/li>\n<li><strong>Pluggable ecosystem support<\/strong> - remains compatible with plugins relying on WordPress auth hooks<\/li>\n<li><strong>Reduced security surface<\/strong> - avoids duplicating sensitive credential logic in plugin code<\/li>\n<\/ul>\n\n<p>Security controls enforced on this endpoint:<\/p>\n\n<ul>\n<li><strong>POST-only processing<\/strong> - non-POST requests are rejected<\/li>\n<li><strong>Nonce verification<\/strong> - <code>borderage_visitor_login<\/code> must be valid before authentication<\/li>\n<li><strong>Input hardening<\/strong> - login and redirect input are normalized\/sanitized<\/li>\n<li><strong>Safe redirect handling<\/strong> - redirect target is validated before use<\/li>\n<li><strong>Login rate limiting<\/strong> - failed attempts are throttled with anonymized references (no IP storage)<\/li>\n<li><strong>No long-lived guest-flow sessions<\/strong> - <code>remember =&gt; false<\/code> disables persistent \"remember me\" cookies in this flow<\/li>\n<li><strong>HTTPS-aware cookie behavior<\/strong> - <code>is_ssl()<\/code> aligns auth cookie security with the current transport context<\/li>\n<\/ul>\n\n<p>If WordPress authentication fails, the plugin falls back to visitor-account authentication while keeping the same nonce, redirect validation, and rate-limiting safeguards.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Initial release<\/li>\n<li>Unified login form with WordPress-first authentication and visitor fallback<\/li>\n<li>Login brute-force protection with anonymized rate-limit tracking (no IP stored)<\/li>\n<li>Age verification via hand gesture<\/li>\n<li>Full site or specific page protection<\/li>\n<li>Visitor account system<\/li>\n<li>Multi-language support (EN, FR, DE, ES)<\/li>\n<li>Customizable verification page<\/li>\n<li>Debug mode for testing<\/li>\n<li>Credit alert system<\/li>\n<li>Rate limiting protection<\/li>\n<li>Health logging system<\/li>\n<li>Statistics dashboard<\/li>\n<li>Developer tools<\/li>\n<li>8 admin configuration tabs<\/li>\n<li>Token-based callback security<\/li>\n<li>Permalink requirement check<\/li>\n<\/ul>","raw_excerpt":"Protect your WordPress pages by verifying visitor age via the BorderAge API using hand gesture recognition.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/282721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=282721"}],"author":[{"embeddable":true,"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/brekam"}],"wp:attachment":[{"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=282721"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=282721"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=282721"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=282721"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=282721"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/azb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=282721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}