Prove there is a person, without asking them to prove it.

<script src="https://verify.yunzheng.space/v1.js?v=1.4.0" async defer></script>

<form method="post" action="/login">
  <div class="orbit-verify" data-sitekey="ovk_…" data-action="login"></div>
  <button type="submit">Sign in</button>
</form>

The script renders every .orbit-verify container on the page and injects a hidden field named orbit-verify-response into the surrounding form. Create the site key on the Verify page in the console.

Each site key carries a security level. Every level applies the same checks: User-Agent against the platform the page reports, the request headers a browser sets and page script cannot, browser APIs against the claimed version, interaction and timing, and network and device history. The level sets the risk score at which the visitor is asked to confirm, the score at which the request is refused, and the cost of the proof of work.

Recommended: maximum for sign-up, sign-in, password reset and payment; strict for comment and contact forms; standard for low-value submissions. The live widget on this site runs at maximum. Set the level per key in the console.

If your pages send a Content-Security-Policy, list both verification hosts in connect-src: https://verify.yunzheng.space https://verify.edge.yunzheng.space. The widget asks the nearest edge first and falls back to the first host on its own, so naming only the first still works — it just gives up the nearer answer.

The token in the form field is worth nothing until you confirm it. Confirm it once, server-side, before you act on the submission.

const r = await fetch("https://verify.yunzheng.space/v1/siteverify", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    secret: process.env.ORBIT_VERIFY_SECRET,
    response: req.body["orbit-verify-response"],
    remoteip: req.ip,
  }),
});
const v = await r.json();
// { success, challenge_ts, hostname, action, score, "error-codes": [] }
if (!v.success) return res.status(400).send("verification failed");

A token can be confirmed once. A second confirmation of the same token fails, which is what stops a captured submission from being replayed.

• No cookies, no iframe, and nothing loaded from a third party.
• No keystrokes and no pointer coordinates are collected.
• Visitor addresses are never stored in the clear.
• Nothing that would let one site's visitors be recognised on another.