# OpenWAF Verify widget and per-zone browser challenge settings

> A first-party proof-of-work widget with siteverify, and a browser challenge with single-use challenges, IPv6 /64 binding and per-zone settings.

**OpenWAF Verify** is a widget you embed in a form: the browser solves a short proof of work and your server checks its single-use token with `POST /__waf/challenge/siteverify` on your own host or `POST https://dash.openwaf.dev/v1/challenge/siteverify`. Script, worker and endpoints are served by the edge on your host, so there is no third-party iframe or cookie and it works with `Content-Security-Policy: default-src 'self'`. Siteverify field names match Cloudflare Turnstile's. Create widgets in **Security → Verification**, with `/v1/orgs/{org}/zones/{zone}/challenge/widgets`, `challenge widget-add` in the CLI or `challenge_widgets` in MCP; secrets are shown once and rotate with 24 hours of overlap. See [OpenWAF Verify widget](https://developers.openwaf.dev/waf/verify-widget/) and the [siteverify reference](https://developers.openwaf.dev/waf/siteverify/).

The **browser challenge** interstitial is now in English and Spanish with a status line for screen readers and a message without JavaScript. Challenges are single use, passes are bound to the visitor's IPv4 /24 or IPv6 /64, and the work runs in a Web Worker as four smaller puzzles. Each zone sets the pass lifetime, difficulty, pass scope, colour and gate with `challenge.*` settings, and **Security → Verification** shows issued, solved, failed and abandoned challenges with the p50 and p95 solve time (`challenge_report` in MCP). See [Browser challenge](https://developers.openwaf.dev/waf/browser-challenge/).