Identity verification for WordPress & WooCommerce using the Didit SDK.

This plugin connects to the Didit identity verification service. When a verification session is created (API mode), the plugin sends data to Didit's servers. The verification UI loads in an iframe from verify.didit.me.

• Service: https://didit.me
• Terms of Use: https://didit.me/en/terms/identity-verification/
• Privacy Policy: https://didit.me/en/terms/privacy-policy/

No data is sent until the administrator configures credentials and a user initiates verification.

cd wordpress-plugin
docker compose up -d

Open http://localhost:8080 and complete the WordPress setup wizard.

Plugins → Didit Verify → Activate

Settings → Didit Verify

1. Set Mode to UniLink
2. Paste your UniLink URL (from Didit Console → Workflow → Copy Link)
3. Save

1. Set Mode to API Session
2. Enter your Workflow ID and API Key
3. Optionally configure Session Options:
   • Vendor Data — identifies each user in Didit (see below)
   • Callback URL — URL to redirect the user after verification (Didit appends verificationSessionId and status as query params)
   • Callback Method — initiator (device that started), completer (device that finishes), or both
   • Language — verification UI language (auto-detect or pick from 49 options)
4. Save

In API mode the plugin creates a unique verification session per user. The API key is stored on the server and never sent to the browser.

Configure how the verification UI appears:

Customize the verification button from Settings → Didit Verify → Button Appearance:

A live preview in the admin panel updates in real time as you change values.

Create a page and add:

[didit_verify]

This renders a verification button styled with your Button Appearance settings.

Override text per page:

[didit_verify text="Verify Now" success_text="Done!"]

Override display mode per shortcode:

[didit_verify mode="embedded"]

Show verification status anywhere:

[didit_status]

Displays "Identity Verified" or "Not Verified" for the logged-in user. You can customize all labels:

[didit_status verified_text="Verified!" unverified_text="Pending" login_text="Sign in first"]

Restrict content to verified users only:

[didit_gate]This content is only visible to verified users.[/didit_gate]

Unverified users see a message and a verification button. You can customize the message:

[didit_gate message="Please verify to continue."]Secret content here.[/didit_gate]

1. Check Require identity verification at checkout in settings
2. Choose a Position for the verification section:
   • Top of checkout page
   • After billing details
   • After order notes
   • Before "Place Order" (recommended)
3. Check Send Billing Data (enabled by default) — automatically sends the customer's billing info to Didit:
   • contact_details: email, phone
   • expected_details: first_name, last_name, country, full address
   • Country codes are automatically converted from WooCommerce alpha-2 to Didit's alpha-3 format

The session ID is saved to order meta (_didit_session_id) and visible in the admin order screen.

The Vendor Data field tells Didit which user each verification belongs to, enabling session aggregation in your Didit dashboard. Choose a mode in the admin settings:

For guest users (when "Require Login" is off), the plugin falls back to guest-{ip_hash}.

When creating a session, the plugin sends:

All data is sanitized server-side before being sent to the Didit API.

wordpress-plugin/
├── didit-verify.php              # Plugin logic (admin, REST API, shortcode, WC)
├── assets/
│   ├── css/didit-verify.css      # Structural styles (embed container)
│   └── js/didit-verify.js        # Frontend SDK integration
├── uninstall.php                 # Cleans up options on plugin deletion
├── readme.txt                    # WordPress.org plugin directory format
├── docker-compose.yml            # Local dev (WordPress + MySQL)
└── README.md

User clicks button → JS calls DiditSdk.startVerification({ url }) → Modal opens
→ User completes verification → onComplete fires → Button shows "Verified"

User clicks button
→ JS sends POST /wp-json/didit/v1/session with:
    X-WP-Nonce (CSRF)  +  billing data (if WC checkout)
→ PHP checks: nonce ✓ → login ✓ → rate limit ✓
→ PHP calls Didit API with API key (server-side) → returns { url }
→ JS calls DiditSdk.startVerification({ url }) → modal opens
→ User completes → onComplete fires → button shows "Verified"
→ JS sends POST /wp-json/didit/v1/verify → saves result to user meta

Same as above, plus:
→ Billing data (name, email, phone, address) auto-sent as expected_details
→ Country code converted from alpha-2 to alpha-3 automatically
→ Session ID written to hidden checkout field
→ On "Place Order", PHP validates the field is not empty
→ Session ID saved to order meta (_didit_session_id)
→ Visible in admin order screen

The plugin acts as a secure backend proxy between the browser and the Didit API. A hacker cannot create sessions directly — every request goes through multiple security layers:

The expected_details (name, country, address) are sent from the checkout form. A hacker could theoretically modify them — but this only hurts themselves: Didit compares these against the real identity document. Fake expected details → verification fails. They can't use this to pass verification.

add_filter( 'didit_sdk_url', function () {
    return 'https://unpkg.com/@didit-protocol/sdk-web@0.1.6/dist/didit-sdk.umd.min.js';
} );

Button appearance is configured in the admin panel (Settings → Didit Verify → Button Appearance). For additional CSS overrides, the button has the class didit-verify-btn and gains didit-verified after successful verification:

/* Override admin styles */
.didit-verify-btn {
    box-shadow: 0 2px 8px rgba(0,0,0,0.15);
}
.didit-verify-btn:disabled {
    opacity: 0.5;
}
.didit-verify-btn.didit-verified {
    background: #16a34a !important;
}

When a user completes verification, the plugin saves these fields to WordPress user meta:

You can query this in PHP:

$is_verified = get_user_meta($user_id, '_didit_verified', true);

A Didit column appears in the admin Users list showing a green checkmark for verified users and a dash for unverified.

The plugin fires WordPress actions that other plugins can hook into:

// Fired when a verification session is created (server-side).
add_action('didit_session_created', function ($url, $user_id, $vendor_data) {
    // Log, notify, etc.
}, 10, 3);

// Fired when a user completes verification.
add_action('didit_verification_completed', function ($user_id, $session_id, $status) {
    // Update CRM, send email, grant access, etc.
}, 10, 3);

// Fired when a user cancels verification.
add_action('didit_verification_cancelled', function ($user_id, $session_id) {
    // Log cancellation.
}, 10, 2);

A DOM event is also dispatched for frontend JavaScript:

document.addEventListener('didit:complete', function (e) {
    console.log('Result:', e.detail); // { type, session }
});

When the plugin is deleted via the WordPress admin, uninstall.php removes all plugin options from the database. User meta (_didit_verified, etc.) is preserved so verification status is not lost.

docker compose exec wordpress wp plugin install woocommerce --activate --allow-root

GPL-2.0-or-later — Copyright © 2025 Didit.