OpenWAF Verify is a widget you embed in a form: the browser solves a short proof of work and your server checks its single-use token with POST /__waf/challenge/siteverify on your own host or POST https://dash.openwaf.dev/v1/challenge/siteverify. Script, worker and endpoints are served by the edge on your host, so there is no third-party iframe or cookie and it works with Content-Security-Policy: default-src 'self'. Siteverify field names match Cloudflare Turnstile's. Create widgets in Security → Verification, with /v1/orgs/{org}/zones/{zone}/challenge/widgets, challenge widget-add in the CLI or challenge_widgets in MCP; secrets are shown once and rotate with 24 hours of overlap. See OpenWAF Verify widget and the siteverify reference.
The browser challenge interstitial is now in English and Spanish with a status line for screen readers and a message without JavaScript. Challenges are single use, passes are bound to the visitor's IPv4 /24 or IPv6 /64, and the work runs in a Web Worker as four smaller puzzles. Each zone sets the pass lifetime, difficulty, pass scope, colour and gate with challenge.* settings, and Security → Verification shows issued, solved, failed and abandoned challenges with the p50 and p95 solve time (challenge_report in MCP). See Browser challenge.