Title: The Goldens Cards KYC Gate Author: mkm1971 Published: October 30, 2026 Last modified: October 30, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/the-goldens-cards-kyc-gate.svg) # The Goldens Cards KYC Gate By [mkm1971](https://profiles.wordpress.org/mkm1971/) [Download](https://downloads.wordpress.org/plugin/the-goldens-cards-kyc-gate.1.1.2.zip) * [Details](https://wordpress.org/plugins/the-goldens-cards-kyc-gate/#description) * [Reviews](https://wordpress.org/plugins/the-goldens-cards-kyc-gate/#reviews) * [Installation](https://wordpress.org/plugins/the-goldens-cards-kyc-gate/#installation) * [Development](https://wordpress.org/plugins/the-goldens-cards-kyc-gate/#developers) [Support](https://wordpress.org/support/plugin/the-goldens-cards-kyc-gate/) ## Description The Goldens Cards KYC Gate stops customers from ordering until they have verified their identity with [Sumsub](https://sumsub.com). It is built for shops that must prevent fraud, chargebacks and stolen-card purchases. **How it works** * Customers verify their identity (ID document + liveness selfie) in the Sumsub WebSDK on My Account Identity verification, or on any page with the `[sskyc_verification]` shortcode. * Unverified customers who open the checkout are redirected to the verification page. * Orders are blocked on the server for the classic checkout, the Cart/Checkout blocks (Store API) and the “Pay for order” page, so the rule cannot be bypassed. * Approval comes only from Sumsub: a signed webhook (HMAC SHA-256/SHA-512) or a server-to-server API lookup. The browser never decides the result. * Rejected (final) and deactivated applicants cannot order. “Resubmission requested” sends the customer back to verification. * Guest checkout is disabled while the gate is active, because verification is tied to a customer account. * Each order stores the KYC status, applicant ID and verification level at the time of purchase. **Anti-fraud** * Billing name must match the name on the verified ID document (locked on the classic checkout). Combine with 3-D Secure in your payment gateway so the card-holder’s bank confirms the card owner. * Optional: block VPN, proxy and Tor connections during verification and checkout( proxycheck.io). * Optional: billing country must match the visitor’s IP country. **Admin** * KYC column on the Users screen, KYC panel on each user profile (status, Sumsub applicant link, re-sync, logged manual override). * Roles can be exempted (administrators and shop managers by default). * Compatible with High-Performance Order Storage (HPOS) and the Cart/Checkout blocks. A Sumsub account is required. This plugin is not affiliated with or endorsed by Sumsub. This plugin is a tool to help reduce fraud. It does not by itself make your store compliant with KYC, AML or data-protection laws; you remain responsible for your own compliance. ### External services This plugin connects to the following third-party services. Nothing is sent until you enter your credentials (Sumsub) or enable the VPN check (proxycheck.io). **Sumsub (identity verification)** – required for the plugin to work. * What it is used for: creating the verification session for a customer, showing the verification widget, and reading the verification result. * What is sent and when: - When a logged-in customer opens the verification page, the plugin sends Sumsub a random customer identifier generated by the plugin, the customer’s email address and your verification level name (`api.sumsub.com`). - The customer’s browser loads the Sumsub WebSDK script from `static.sumsub. com` and sends the documents, selfie and device data the customer provides directly to Sumsub. - When a webhook arrives, when the customer’s status is refreshed, and (optionally) at checkout, the plugin requests that customer’s verification status and verified name from `api.sumsub.com`. * Sumsub Terms of Use: https://sumsub.com/terms-of-use/ * Sumsub Privacy Notice: https://sumsub.com/privacy-notice-website/ **proxycheck.io (VPN / proxy detection)** – only when “Block VPN / proxy / Tor” or “Billing country must match IP country” is enabled. * What it is used for: detecting VPN, proxy and Tor connections and the country of the visitor’s IP address. * What is sent and when: the visitor’s IP address (and your API key, if set) when a customer opens the verification page or places an order. Results are cached for 6 hours. * proxycheck.io Terms: https://proxycheck.io/terms * proxycheck.io Privacy Policy: https://proxycheck.io/privacy ### Author Developed by Khalaf Almazrouei for The Goldens Cards (https://thegoldenscards.com). ## Installation 1. Install and activate the plugin (WooCommerce must be active). 2. In the Sumsub dashboard, create an App Token and Secret Key (Dev space App tokens). Grant: Create applicants, Create verification requests, View applicants, View approved applicants, View applicant’s personal data. 3. Create a verification level (Integrations Applicant levels), for example ID document + liveness selfie, and note its exact name. 4. Go to WooCommerce Settings KYC Gate and enter the App Token, Secret Key and level name. You can instead define `SSKYC_APP_TOKEN`, `SSKYC_SECRET_KEY` and `SSKYC_WEBHOOK_SECRET` in wp-config.php. 5. In Sumsub (Dev space Webhooks), add the webhook URL shown on the settings page with the types applicantReviewed, applicantPending, applicantOnHold, applicantReset, applicantDeactivated and applicantActivated, signature SHA256. Copy its secret into “Webhook secret key”. 6. If the Identity verification page returns 404, go to Settings Permalinks and click Save. 7. Test with Sumsub sandbox credentials before going live. ## FAQ ### Can a customer bypass the check by calling the Store API directly? No. The rule is enforced on the server for classic checkout, block checkout (Store API) and the order-pay page. ### Does the plugin stop stolen cards? It locks the billing name to the verified ID name and can block VPNs. WordPress cannot see the name printed on a card, so also enable 3-D Secure in your payment gateway; the card-holder’s bank then confirms the card owner. ### My site is behind Cloudflare or a reverse proxy. Set “Visitor IP source” to CF-Connecting-IP (Cloudflare) or X-Real-IP (Traefik/Coolify/ nginx), otherwise every visitor appears to come from the proxy. ### What happens to the data when I uninstall? Settings are deleted. KYC records on users and orders are kept as an audit trail. ### Developer hooks * `sskyc_requires_kyc` filter – `( bool $required, int $user_id )`. * `sskyc_status_changed` action – `( int $user_id, string $new, string $old, array $context )`. * `sskyc_ip_lookup` filter – plug in another IP-intelligence provider. * `sskyc_fraud_blocked` action – fires when an anti-fraud rule blocks a customer. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “The Goldens Cards KYC Gate” is open source software. The following people have contributed to this plugin. Contributors * [ mkm1971 ](https://profiles.wordpress.org/mkm1971/) [Translate “The Goldens Cards KYC Gate” into your language.](https://translate.wordpress.org/projects/wp-plugins/the-goldens-cards-kyc-gate) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/the-goldens-cards-kyc-gate/), check out the [SVN repository](https://plugins.svn.wordpress.org/the-goldens-cards-kyc-gate/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/the-goldens-cards-kyc-gate/) by [RSS](https://plugins.trac.wordpress.org/log/the-goldens-cards-kyc-gate/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.2 * Renamed to The Goldens Cards KYC Gate. Author details added. * VPN check is now opt-in. Escaping improvements. #### 1.1.1 * Fix: name matching for IDs that store the full name in one field. * Clearer log messages for name checks. #### 1.1.0 * Anti-fraud: billing name must match the verified ID, VPN/proxy/Tor blocking, optional country match. #### 1.0.2 * Plugin Check fixes. #### 1.0.0 * First release. ## Meta * Version **1.1.2** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.7 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [checkout](https://wordpress.org/plugins/tags/checkout/)[fraud prevention](https://wordpress.org/plugins/tags/fraud-prevention/) [Identity Verification](https://wordpress.org/plugins/tags/identity-verification/) [kyc](https://wordpress.org/plugins/tags/kyc/)[woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/the-goldens-cards-kyc-gate/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/the-goldens-cards-kyc-gate/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/the-goldens-cards-kyc-gate/reviews/) ## Contributors * [ mkm1971 ](https://profiles.wordpress.org/mkm1971/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/the-goldens-cards-kyc-gate/)