XY Zinc

What XY Zinc is

XY Zinc is a brand of Chaos Unlimited LLC. The company says it has been building developer tools since 1999 and has owned its domain since then, and its about page claims more than 25 years of running websites in regulated spaces. The pages present two products that touch adult sites: an age verification API with a WordPress plugin, and XYZ Protect, a media protection plugin with a built-in region-based adult verification option. The age check is the core of the offer, sold per credit and set up either through the plugin or straight against the API.

What it sells an operator

Verification runs in two tiers. Tier 1 is a face check: liveness detection that confirms a real person is present and then classifies the probability that the user is a minor. Tier 2 adds a government ID capture, extracts the date of birth and matches the face to the ID, for regions that need definitive proof. Each region can be set to Tier 1, Tier 2, allowed without verification, or blocked, with a custom minimum age of 18, 21 or another figure. The age verification page gives an example in which Texas is set to Tier 2 and the United Kingdom to Tier 1.

Pricing is by credit. The free WordPress plugin includes 100 verification credits per month at no cost, with no credit card required. In October 2026 the WordPress plugin page lists credit packs of 250 credits for $15.00 and 1,000 credits for $45.00, where one credit is used per face check attempt and 2 per document attempt. The contact page says Tier 1 verifications start at $0.05 and Tier 2 at $0.15, while the protect page gives verification credits starting at $0.038 each, so the pages quote per-verification prices on different bases. The separate XYZ Protect media plugin is sold at $15 a month or $150 a year, and verification credits for its age module are bought separately.

XYZ Protect itself guards a WordPress site's media files rather than its pages. Requests are checked at the edge of a global network before they reach WordPress, and protected media is served from an edge cache the page puts at 300+ locations. It offers two modes: a guard cookie that hides media URLs from visitors without authorization, and encrypted URLs that are unique to each visitor and expire on their own, so a copied link stops working. A tiered mode maps the two to MemberPress and Paid Memberships Pro levels, files stay where they are on the server, and the plugin blocks unauthenticated access to the WordPress REST API media endpoints. A trial covers 10,000 protected media requests, and on cancellation protection runs to the end of the billing period.

Integration is a REST API that the company says works with any platform able to make HTTP requests, with guides for Classic ASP, Node.js, Python and PHP and a WordPress plugin. XYZ Protect setup adds one CNAME and two TXT records at the DNS host. The age verification plugin is set up with a registration email, an API key, an age gate page carrying a shortcode, and a test mode that simulates regions. The company says installation takes about 15 minutes.

The privacy design is the main pitch on the pages. The company says it never stores user photos or selfies, ID document images, names or addresses, ID numbers or dates of birth, or biometric templates. What it does keep is an anonymous session ID, the verification result, confidence scores for quality reporting, IP addresses for fraud prevention and timestamps for the audit trail.

The terms that decide the choice

There are no content rules written for adult customers. The terms do list prohibited uses for the service, including using it to circumvent age verification for minors and facilitating illegal activity. The terms place the compliance burden on the customer. The customer decides whether verification is required, configures regional rules, gives end users privacy disclosures and handles the results. The terms say the company supplies the tools and the customer stays responsible for how they are used and for the laws that govern its business.

The terms also say the customer must tell its end users that a third-party service handles verification, and that the company acts as a data processor on the customer's behalf. Liveness detection is said to run on AWS Rekognition Face Liveness, which the page says achieved a perfect score on iBeta Level 2 presentation attack testing. The about page says the company is pursuing IEEE 2089.1 certification through the Age Check Certification Scheme.

On payment, invoices are due within 30 days of issue and the company may suspend or end access for unpaid fees. The company disclaims any warranty that the service is uninterrupted, error-free or 100% accurate, and says it does not warrant that it will meet every regulatory requirement in every jurisdiction. Liability is capped at the fees paid in the 12 months before a claim, and the customer indemnifies the company for claims arising from its use of the service. The terms are governed by Delaware law, require 30 days of informal resolution, and send disputes to arbitration under American Arbitration Association rules, with a waiver of class actions.

No refund terms are given beyond the cancel-anytime line on the XYZ Protect plan and the terms' clause on ending an account by contacting the company.

Getting started and support

Setup needs WordPress 5.0 or later, PHP 7.4 or later, HTTPS, and proxying through Cloudflare, because regional rules rely on Cloudflare geo headers. The protect page says a free Cloudflare account on the main domain is needed for geographic detection. Caching is a known limit: the page says WP Rocket's static file mode is not compatible, and that the plugin has been tested with WP Super Cache, Jetpack Boost and W3 Total Cache.

Support is a forum for setup guides and troubleshooting, plus email addresses for general inquiries and API integration. The contact page gives a response time of 1-2 business days, and says existing customers can use their support documentation for urgent API issues. The Pro plan adds priority support and dedicated onboarding.

Company and track record

The pages name Chaos Unlimited LLC as the owner and operator, and the terms name the same company. They do not give a team, a headquarters address or a count of customers. They do not name any customer, and the about page says the service began when the company needed age checks on its own sites. The pages describe the XY Zinc name as deliberately plain, so that the operator's brand stays in front of the visitor.

Who it suits

Age verification is the primary category, and the protect page ties the second product to it: for sites serving age-restricted content, XYZ Protect includes region-based adult verification. XY Zinc fits a WordPress operator that wants to test region rules on a free tier, and an operator with a custom stack that wants an API with tiered checks. A site that already uses a membership plugin and needs its media protected as well as its age gate may also find the combination useful.

It fits less well where a site cannot be proxied through Cloudflare, where it runs WP Rocket's static caching, or where the operator needs the business-side agreement before it signs. The terms say fees are set in a service agreement or order form, which the pages do not reproduce. Per-verification prices are quoted in more than one form. The company does not guarantee uninterrupted service, and it says verification is one component of a compliance program rather than the whole of it.

The main draw is the data design: the vendor says it keeps no selfies, ID images or biometric templates, and it offers the tiers and regional rules needed to avoid paying for ID checks where a face check is enough.