On a fast connection the proof of work of under attack mode finished before visitors noticed it, and a script that could compute SHA-256 passed just the same. The challenge page now adds an interactive step: once the proof of work is solved, it shows the site's name, «Verify you are human by completing the action below.» and a verification box with a «Verify you are human» checkbox («Verifica que eres humano» in Spanish) next to the zone's brand, in its accent colour. Ticking it turns the checkbox into a spinner with «Verifying…», then a green check with «Success», and the page loads; a failure shows a red cross and «Try again». The checkbox is a real control: it takes the focus, Space ticks it, and every state is announced to screen readers. A footer «Protected by OpenWAF | ID: …» gives an ID that support can use to find that page's verification attempts.
Only a trusted browser input event counts (a click, a tap, or Space or Enter): a click or checked = true from a page script submits nothing, and a solve sent less than half a second after the challenge was issued is rejected with interaction-required, which stops instant replays. Browsers that report they are automated get the same box, with no extra fingerprinting. Passes, their lifetime and scope don't change.
The step is friction for scripts, not proof of a human: automation that injects input through the browser or the operating system (Playwright or Puppeteer over the DevTools protocol, for example) produces trusted events and can pass. It makes each new pass cost a real interaction.
The Verify widget uses the same box for its interactive state, and the test site key owk_test_interactive shows it.
The step is on by default. Set challenge.under_attack.interactive to false for the proof of work alone: Ask to tick a box in the under attack card of the dashboard, "interactive": false in PATCH /v1/orgs/{org}/zones/{zone}/edge, openwaf-cloud ctl zones under-attack example.com on --interactive=false, or interactive in the MCP tool under_attack. Solves through the box are counted as interactive in the Verification analytics.