Orbit Verify replaces a CAPTCHA on sign-up, login and contact forms while keeping out the same bots. Most visitors never click anything; your server confirms each submission with one request. No cookies, no tracking, free for non-commercial use.
Per site key.
standard — asks to confirm at risk 0.35, refuses at 0.70, 16-bit proof of workstrict — 0.25 / 0.55, 17-bitmaximum — 0.15 / 0.40, 18-bit; recommended for sign-up, sign-in and paymentmaximumNo puzzles.
Two lines on the page.
Collect as little as possible.
Same rules as every Orbit product.
Put the container inside the form you want to protect. The widget adds the result to the form for you; the server-side check and examples are in the console next to your key.
<script src="https://verify.yunzheng.space/v1.js?v=1.4.0" async defer></script> <div class="orbit-verify" data-sitekey="ovk_…"></div>
Replace ovk_… with your key from the console.
A form protected by Orbit Verify. Type anything, wait for the check, then send.
The widget runs a short automatic check in the visitor's browser and looks at a few coarse facts about it, such as whether it reports being automated, its time zone and screen size, and whether the page saw any pointer or keyboard activity. It never reads what visitors type or where the pointer went. The visitor's address is kept only briefly, in a form that cannot be reversed, to answer the request and limit abuse. Your site receives one answer: whether the check passed.
A site protected by Orbit Shield may also run the presence sensor. It puts the same checks on every page of a website instead of once on a form: a small script from the same website reports the same coarse facts this widget reports — screen and viewport, how many clicks and key presses happened and their rhythm, which standard features the browser has, whether the page stayed visible, how long things took — every thirty seconds and whenever the page is hidden or shown. What it collects is identical to what this widget collects, and so is what it never collects: not what you type, not where the pointer went, not the contents of the page. The report goes to the same website you are already on and nowhere else. The answer comes back as one cookie, __orbit_sense, which holds exactly three things: a score from 0 to 100, the moment that score stops counting (ten minutes later), and a signature proving the network wrote it. There is nothing in it that identifies you, and the page cannot read it.
| Allowance | Free |
|---|---|
| Verifications a month | No limit |
| Site keys | No limit |
Allowances are per account. If you need more, open a ticket at the Help Centre. Usage is in the console. All platform plans
It solves the same problem as a CAPTCHA — telling a real visitor from a bot — without puzzles to solve. Most visitors see nothing at all; a single click appears only once a browser's risk score crosses the key's threshold.
Yes. Your server-side check keeps the same shape, and on the page you replace the other service's two lines with Orbit's. The console shows both.
Usually not. The check completes on its own while the page loads. When a browser risk score reaches the key’s escalation threshold, a single checkbox appears. A key can also be set to always or never show it.
A few coarse facts about the browser and whether the page saw real activity. Never the content typed, never pointer positions. No cookies, no iframes, no third-party requests.
Free for non-commercial use. Commercial use runs on a pack; current usage is visible in the Orbit console.
Yes. Each key has a list of allowed sites, including all subdomains of a domain if you want. Local development addresses are always allowed.