This page is for creators who've been thinking about leaving OnlyFans — or are already off it — and want to know what running your own operation actually looks like.
XYZ Protect Edge is in development. It's not ready yet, and this isn't a sales page. It's a preview. I'm sharing what I'm building, how it works, and what the honest tradeoffs are, so that the people it's designed for can tell me whether I'm solving the right problem.
If it sounds interesting, email me at [email protected].
The problem it solves
OnlyFans keeps 20% of everything you earn. For a creator making $5,000 a month, that's $12,000 a year. For a creator making $25,000 a month, it's $60,000. The money is real. The problem is that every dollar you earn on their platform — or any platform — is a dollar you earn on their terms, on their infrastructure, with their ability to cut you off.
The alternative is running your own site. WordPress, a membership plugin like Paid Memberships Pro, an adult-friendly host like MojoHost, and a merchant account through CCBill or Segpay or similar. That stack exists and it works. The problem is that "WordPress + membership plugin" doesn't actually protect your media. Membership plugins protect pages. Anyone who grabs a direct URL to a file in your uploads folder — from page source, from browser dev tools, from a link a subscriber shares — can download it without paying, without being a member, without being verified. The membership gate is a front door with no back wall.
That's what Edge fixes.
What Edge is
Edge is a WordPress plugin plus a hosted service that routes your protected media through Cloudflare infrastructure provisioned in your own Cloudflare account. When a visitor requests one of your images or videos, the request goes through an authorization layer at the network edge before it ever reaches your origin server. Unauthorized requests get a placeholder. Authorized requests get the file. Your WordPress site never touches the file in transit.
The key architectural decision: your media lives in your Cloudflare R2 account — not mine. Your storage bill goes to Cloudflare directly, at Cloudflare's wholesale rates. If you ever leave Edge, your files don't go anywhere. They're in your account.
Edge doesn't process your payments. You keep your merchant account with CCBill, Segpay, Epoch, Verotel, NETbilling, or whoever processes for you. Edge writes the connector that wires your processor into Paid Memberships Pro or MemberPress, but the merchant relationship is yours.
The stack it composes
Edge isn't a turnkey platform. It's glue for a stack you own end to end:
WordPress runs your site. Mainstream, broadly supported, adult-permissive.
MojoHost or equivalent adult-friendly hosting runs WordPress. They won't deplatform you for your content.
Paid Memberships Pro or MemberPress handles memberships. Both have free or open-source cores. Your subscriber database, your membership tiers, your content rules.
Adult-industry payment processors — CCBill, Segpay, Epoch, Verotel, NETbilling — handle billing through your own merchant account. Edge builds the connectors that make these work with the membership plugins; the processor relationship is yours.
Cloudflare handles storage and delivery, provisioned in your account. R2 for media storage (no egress fees). Cloudflare Stream for video. Workers for authorization.
XYZ Age Verification gates your site for visitors from states and jurisdictions that require actual verification — not a "click to confirm you're 18" popup, but real biometric liveness detection, with government ID verification for industries that require 21+. This is a separate XY Zinc product that integrates with Edge; see below.
Edge ties it together: the upload pipeline, the authorization layer, the WordPress plugin, the orchestration that provisions your Cloudflare resources, and the documentation and support for running this stack as a creator rather than as a developer.
How media protection works
When you upload an image or video through Edge:
The file goes through a processing pipeline before it reaches storage. MIME type verification confirms the file is what it claims to be. Virus scanning rejects known malware signatures. Images are decoded and re-encoded into sanitized form, and variants are generated — different sizes, WebP and AVIF formats — so your site serves the right format to every device without you thinking about it. Only after all of that succeeds does the file land in your R2 bucket.
When a visitor loads a protected page, Edge issues them an encrypted, time-limited, user-bound token embedded in the media URL. The token is tied to their session. If they copy the URL and send it to someone else, the token won't validate for that other person. If the token expires, the URL returns a placeholder, not the file. Your actual filenames are never exposed in page source or browser history.
Visitors who aren't authorized — not logged in, not a member, not verified — see placeholders where your protected media would be. The placeholder is configurable. The real file never leaves storage.
Age verification
Several states — Texas, Louisiana, and others — require sites that host adult content to verify visitor ages using actual verification, not a checkbox. XYZ Age Verification handles this. It integrates directly into the Edge stack and runs verification on your own subdomain (verify.yourcreatorsite.com), so your visitors never leave your brand.
How it works: visitors from regulated jurisdictions are intercepted before they see any content and redirected to an age gate page. Tier 1 is biometric liveness detection — confirms a real person is present and classifies minor probability. Tier 2 adds government ID capture and face matching, required for 21+ industries and jurisdictions with stricter mandates. Images are processed in memory and deleted immediately on completion; no photos, no ID scans, no biometric templates are ever written to disk or retained. Once verified, the visitor gets a token that covers your site for up to a year.
Visitors from regions that don't require verification pass through without seeing the gate. You configure which regions require which tier, and the system handles routing automatically. You can also block regions entirely or allow without verification — it's per-region, per-tier configuration.
Member record flagging and the login bypass: When a subscriber completes age verification, that fact is recorded on their membership record — not just in a cookie. On subsequent visits, a logged-in member whose record is flagged as verified bypasses the age gate entirely at the login path, without consuming another verification. This matters practically because verification cookies are per-device and don't carry across a subscriber's phone, tablet, and laptop. Without the membership flag, a subscriber would face re-verification every time they switch devices. With it, logging in is enough.
Why it's a separate line item: Each verification runs against external APIs — AWS Rekognition for liveness (iBeta Level 2 PAD certified), AWS Textract for document parsing. Those are per-call costs that can't be absorbed into a flat subscription. For Edge clients, verification pricing is negotiated based on your expected volume rather than sold as fixed credit packs. Because verified members bypass the gate on login, your ongoing verification load is genuinely new subscribers and the occasional visitor who hasn't yet created an account — not a recurring cost against your established member base.
The full XYZ Age Verification API page, including the live demo, is at xyzinc.com/age-verify.
What it costs you operationally
Running your own operation is not the same as running a platform account. There are real things you have to handle that OnlyFans handles for you now.
Merchant account. You'll need your own account with an adult-friendly payment processor. This is not trivial. CCBill and similar have an onboarding process. It's navigable, and people in this industry do it routinely, but it takes time and there's paperwork. Edge doesn't do this for you.
Cloudflare account. You'll need a Cloudflare account and a scoped API token so Edge can provision resources into it. Edge walks you through this, but you're creating the account yourself. For most people this takes about 20 minutes; for the least technical it might take longer with some hand-holding.
DNS. Your domain needs to point to your hosting and your media subdomain needs a CNAME record. If you've never touched DNS before, it's learnable, but it's one more thing.
Your Cloudflare bill. Storage in R2 costs $0.015 per GB per month. Egress from R2 is free (this is why Cloudflare was chosen — you don't pay to serve your own content). Stream charges per minute of video stored. For a modest creator, the Cloudflare portion of your bill is likely in the range of a few dollars to a few tens of dollars per month. You'll see the exact number in your own Cloudflare dashboard.
Verification costs, if you need them. If your site requires age verification for any jurisdiction, each verification attempt is billed per-call. For Edge clients, rates are negotiated based on expected volume rather than sold as fixed credit packs. Because verified members bypass the gate on login, your ongoing verification load is primarily new subscribers — not a recurring cost against your established member base on every visit or every new device.
Platform you can't leave. OnlyFans owns your subscriber relationships in a way that isn't exportable. Moving to your own operation means rebuilding your subscriber list on infrastructure you own — which is the whole point, but the transition isn't frictionless.
The right question isn't whether any of this is hard. It's whether the recovered platform cut justifies the operational overhead. For creators earning enough that 20% is a significant number, the math usually does.
What it doesn't do yet
Edge is in development. Being honest about what isn't built yet:
Video is not done. Cloudflare Stream integration is architecturally decided and will be in the product, but it isn't built yet. Right now, Edge protects images and documents. Video protection via Stream is next.
Payment connectors are in progress. CCBill is built, others to follow as the processor relationships are established. Let me know which processors you prefer to work with.
It's not self-serve. There's no sign-up flow you can click through today. Getting started means emailing me, and early customers are going to be working more closely with me than a finished product would require.
The demo site isn't up yet. I'm building toward a working demo with a real creator before expanding to a broader early-access group. The demo is what validates that the assembly works in practice, not just in the spec.
Who this is for
The creator this is designed for is earning enough from content that 20% is a real number — low thousands a month and up — and values owning their setup enough to navigate some operational responsibility in exchange. Not technically sophisticated necessarily, but willing to follow a setup process. Not looking for a turnkey platform to hand everything to, but also not looking to build their own infrastructure from scratch.
It is specifically not for a creator who wants everything handled for them with no operational involvement. That creator should stay on OnlyFans or move to a managed platform. Edge is for creators who understand the tradeoff they're making and have decided ownership is worth it.
What I'm asking for
This product doesn't exist yet in a form you can use. I'm sharing the design before it's finished because I'd rather find out now if I'm solving the wrong problem.
If you're a creator who's been thinking about owning your own operation — or has tried and hit specific walls — I want to hear about it. What you're earning on platform, what you're paying in cut, what you've already tried, where you got stuck. That conversation will directly shape what Edge looks like when it ships.
Email [email protected]. I read everything and I respond.