Invisible to visitors
No puzzles.
- Most visitors pass without clicking
- A single click when a browser looks automated
- Per site: always ask, or never ask
Orbit Verify lets your sign-up, login and contact forms accept only real people. Most visitors never click anything; your server confirms each submission with one request. No cookies, no tracking, free for non-commercial use.
No puzzles.
Two lines on the page.
Collect as little as possible.
Same rules as every Orbit product.
Put the container inside the form you want to protect. The widget adds the result to the form for you; the server-side check and examples are in the console next to your key.
<script src="https://verify.yunzheng.space/v1.js?v=1.2.0" async defer></script> <div class="orbit-verify" data-sitekey="ovk_…"></div>
Replace ovk_… with your key from the console.
A form protected by Orbit Verify. Type anything, wait for the check, then send.
The widget runs a short automatic check in the visitor's browser and looks at a few coarse facts about it, such as whether it reports being automated, its time zone and screen size, and whether the page saw any pointer or keyboard activity. It never reads what visitors type or where the pointer went. The visitor's address is kept only briefly, in a form that cannot be reversed, to answer the request and limit abuse. Your site receives one answer: whether the check passed.
Yes. Your server-side check keeps the same shape, and on the page you replace the other service's two lines with Orbit's. The console shows both.
Usually not. The check completes on its own while the page loads. When a browser looks automated, a single checkbox appears. A key can also be set to always or never show it.
A few coarse facts about the browser and whether the page saw real activity. Never the content typed, never pointer positions. No cookies, no iframes, no third-party requests.
Free for non-commercial use. Commercial use runs on a pack; current usage is visible in the Orbit console.
Yes. Each key has a list of allowed sites, including all subdomains of a domain if you want. Local development addresses are always allowed.