diff --git a/themes/Ying/layouts/page/comment.html b/themes/Ying/layouts/page/comment.html
index af668f37..56687546 100644
--- a/themes/Ying/layouts/page/comment.html
+++ b/themes/Ying/layouts/page/comment.html
@@ -140,4 +140,241 @@
   };
 })();
 </script>
+
+<script>
+/* 人机验证（自研「一键验证」）—— 服务端见 artalk-cf/src/lib/human.ts
+   读者体验：默认什么都不用做（浏览器静默算一个 PoW，约 0.1~2 秒，后台完成）；
+            信号不足时才出现「点一下验证」小方块；再可疑才弹图形验证码。
+   通行证按 IP 记在服务端（KV，30 分钟），前端不传任何 token，所以不需要改 Artalk 客户端。 */
+(function () {
+  var BASE = '{{ $rssBase := site.Params.rssapi.base | default "https://api.200181.xyz" }}{{ $rssBase }}';
+  var API = BASE + '/api/v2';
+  var DIFFICULTY = 4;
+  var PREFIX = new Array(DIFFICULTY + 1).join('0');
+
+  var started = Date.now();
+  var events = 0, honey = '', hasPass = false, busy = false, widget = null, tries = 0;
+
+  // ── 行为信号：人类随手动一下就会有，脚本环境常常一个都没有
+  ['mousemove', 'pointerdown', 'keydown', 'keyup', 'input', 'focusin', 'scroll', 'wheel',
+   'touchstart', 'click'].forEach(function (ev) {
+    document.addEventListener(ev, function () { events++; }, { passive: true });
+  });
+
+  function injectCss() {
+    if (document.getElementById('atk-human-css')) return;
+    var st = document.createElement('style');
+    st.id = 'atk-human-css';
+    st.textContent =
+      '.atk-human-box{display:flex;align-items:center;gap:8px;margin:0 0 10px;padding:8px 12px;' +
+        'border:1px solid var(--border-main,#eee);border-radius:8px;background:var(--bg-card,#fff);' +
+        'font-size:13px;color:var(--text-main,#333);transition:border-color .2s,background .2s}' +
+      '.atk-human-box.is-click{cursor:pointer}' +
+      '.atk-human-box.is-click:hover{border-color:var(--theme-main,#07c160)}' +
+      '.atk-human-box.is-busy{opacity:.7;cursor:default}' +
+      '.atk-human-box-ic{flex:none;width:18px;height:18px;border-radius:50%;display:flex;align-items:center;' +
+        'justify-content:center;font-size:12px;color:#fff;background:var(--theme-main,#07c160)}' +
+      '.atk-human-box.is-captcha .atk-human-box-ic{background:#d9534f}' +
+      '.atk-human-box-tx{flex:1;min-width:0}' +
+      '.atk-human-img{flex:none;height:34px;width:102px;border-radius:4px;cursor:pointer}' +
+      '.atk-human-inp{flex:none;width:78px;padding:4px 6px;border:1px solid var(--border-main,#ddd);' +
+        'border-radius:4px;font-size:13px;box-sizing:border-box;outline:none;background:transparent;color:inherit}' +
+      '.atk-human-btn{flex:none;padding:4px 10px;border:none;border-radius:4px;cursor:pointer;' +
+        'background:var(--theme-main,#07c160);color:#fff;font-size:12px}' +
+      '[data-theme="dark"] .atk-human-box{border-color:rgba(255,255,255,.14)}';
+    document.head.appendChild(st);
+  }
+
+  function hex(buf) {
+    var b = new Uint8Array(buf), out = '';
+    for (var i = 0; i < b.length; i++) out += ('0' + b[i].toString(16)).slice(-2);
+    return out;
+  }
+  function sha256(str) {
+    return crypto.subtle.digest('SHA-256', new TextEncoder().encode(str)).then(hex);
+  }
+
+  /* 找 nonce 让 sha256(challenge+nonce) 以 N 个 0 开头。
+     crypto.subtle 是异步的，逐次 await 的 promise 开销远大于哈希本身：
+     所以按 CHUNK 串一条链、每 CHUNK*YIELD_EVERY 次让出一次主线程，
+     页面保持流畅，总耗时压到 1 秒上下（全程后台，读者无感）。 */
+  var CHUNK = 512, YIELD_EVERY = 8;
+  function solve(challenge) {
+    var i = 0;
+    function step() {
+      var chain = Promise.resolve(null);
+      var found0 = null;
+      var limit = i + CHUNK * YIELD_EVERY;
+      while (i < limit && i < 3000000) {
+        (function (n) {
+          chain = chain.then(function () {
+            if (found0 !== null) return found0;      // 已找到 → 后面的直接短路
+            return sha256(challenge + n).then(function (h) {
+              if (h.slice(0, DIFFICULTY) === PREFIX) { found0 = n; return n; }
+              return null;
+            });
+          });
+        })(i++);
+      }
+      return chain.then(function (found) {
+        if (found !== null) return found;
+        if (i >= 4000000) return null;
+        return new Promise(function (r) { setTimeout(r, 0); }).then(step);
+      });
+    }
+    return step();
+  }
+
+  function api(path, body) {
+    return fetch(API + path, {
+      method: body ? 'POST' : 'GET',
+      headers: body ? { 'Content-Type': 'application/json' } : undefined,
+      body: body ? JSON.stringify(body) : undefined,
+    }).then(function (r) { return r.json().catch(function () { return {}; }); });
+  }
+
+  // ── 控件
+  function editorEl() {
+    return document.querySelector('.atk-main-editor') || document.querySelector('.atk-comment-wrap');
+  }
+  function ensureWidget() {
+    if (widget && widget.isConnected) return widget;
+    var ed = editorEl();
+    if (!ed || !ed.parentNode) return null;
+    widget = document.createElement('div');
+    widget.className = 'atk-human-box';
+    ed.parentNode.insertBefore(widget, ed);
+    injectCss();
+    return widget;
+  }
+  function dropWidget() {
+    if (widget && widget.parentNode) widget.parentNode.removeChild(widget);
+    widget = null;
+  }
+  function ensureHoneypot() {
+    if (document.getElementById('atk-human-hp')) return;
+    var ed = editorEl();
+    if (!ed) return;
+    var i = document.createElement('input');
+    i.id = 'atk-human-hp'; i.type = 'text'; i.tabIndex = -1; i.autocomplete = 'off';
+    i.setAttribute('aria-hidden', 'true');
+    i.style.cssText = 'position:absolute;left:-9999px;top:0;width:1px;height:1px;opacity:0';
+    i.addEventListener('input', function () { honey = i.value; });
+    ed.appendChild(i);
+  }
+
+  function done() {
+    var w = ensureWidget();
+    if (!w) { hasPass = true; return; }
+    w.className = 'atk-human-box';
+    w.onclick = null;
+    w.innerHTML = '<span class="atk-human-box-ic">✓</span><span class="atk-human-box-tx">已通过人机验证</span>';
+    setTimeout(dropWidget, 1600);
+  }
+
+  function showCaptcha() {
+    var w = ensureWidget();
+    if (!w) { if (tries++ < 20) setTimeout(showCaptcha, 800); return; }
+    w.className = 'atk-human-box is-captcha';
+    w.onclick = null;
+    w.innerHTML = '<span class="atk-human-box-ic">!</span>' +
+      '<span class="atk-human-box-tx">请输入图中的字符（点图片可换一张）</span>' +
+      '<img class="atk-human-img" alt="验证码"><input class="atk-human-inp" maxlength="6" autocomplete="off">' +
+      '<button class="atk-human-btn" type="button">确认</button>';
+    var img = w.querySelector('.atk-human-img');
+    var inp = w.querySelector('.atk-human-inp');
+    function refresh() { api('/captcha').then(function (c) { if (c && c.img_data) img.src = c.img_data; }); }
+    refresh();
+    img.onclick = refresh;
+    function submit() {
+      var v = (inp.value || '').trim();
+      if (!v) return;
+      api('/captcha/verify', { value: v }).then(function (r) {
+        if (r && r.msg === 'Success') { hasPass = true; done(); }
+        else { inp.value = ''; refresh(); }
+      });
+    }
+    w.querySelector('.atk-human-btn').onclick = submit;
+    inp.addEventListener('keydown', function (e) { if (e.key === 'Enter') submit(); });
+    inp.focus();
+  }
+
+  function showClick() {
+    var w = ensureWidget();
+    if (!w) { if (tries++ < 20) setTimeout(showClick, 800); return; }
+    w.className = 'atk-human-box is-click';
+    w.innerHTML = '<span class="atk-human-box-ic">✓</span>' +
+      '<span class="atk-human-box-tx">点一下完成验证，然后就能发评论了</span>';
+    w.onclick = function () {
+      if (busy) return;
+      w.className = 'atk-human-box is-busy';
+      w.querySelector('.atk-human-box-tx').textContent = '验证中…';
+      run(true);
+    };
+  }
+
+  // ── 主流程
+  // 证明只算一次并缓存：点「点一下验证」复用同一个 nonce 重发（补上 clicked 信号），
+  // 所以点击是**瞬间完成**的，不会让访客再等一次算力。
+  var proof = null;
+
+  function ensureProof() {
+    if (proof && proof.exp > Date.now() + 5000) return Promise.resolve(proof);
+    return api('/human/challenge').then(function (ch) {
+      if (!ch || ch.enabled === false || ch.pass) return null;
+      return solve(ch.challenge).then(function (nonce) {
+        if (nonce === null) return null;
+        proof = { challenge: ch.challenge, nonce: nonce, exp: ch.exp, sig: ch.sig };
+        return proof;
+      });
+    });
+  }
+
+  function run(clicked) {
+    if (busy) return Promise.resolve();
+    if (hasPass) return Promise.resolve();
+    busy = true;
+    return api('/human/status').then(function (st) {
+      if (!st || st.enabled === false || st.pass) { hasPass = true; dropWidget(); return null; }
+      if (!window.crypto || !crypto.subtle) { showCaptcha(); return null; }
+      return ensureProof().then(function (pr) {
+        if (!pr) { showCaptcha(); return null; }
+        return api('/human/verify', {
+          challenge: pr.challenge, nonce: pr.nonce, exp: pr.exp, sig: pr.sig,
+          elapsedMs: Date.now() - started, events: events,
+          webdriver: navigator.webdriver === true, honeypot: honey, clicked: !!clicked,
+        }).then(function (res) {
+          if (res && res.pass) { hasPass = true; done(); return; }
+          if (res && res.need_captcha) { showCaptcha(); return; }
+          showClick();
+        });
+      });
+    }).catch(function () { /* 网络异常就不打扰读者，服务端仍有图形验证码兜底 */ })
+      .then(function () { busy = false; });
+  }
+
+  function init() {
+    if (!document.querySelector('.comments-area')) return;      // 非评论页不打扰
+    started = Date.now(); events = 0; hasPass = false; busy = false; tries = 0; proof = null;
+    dropWidget();
+    ensureHoneypot();
+    run(false);
+    // 编辑器获得焦点时再确认一次（通行证 30 分钟，长了就续）
+    setTimeout(function () {
+      var ed = editorEl();
+      if (ed) ed.addEventListener('focusin', function () { if (!hasPass) run(false); });
+    }, 1500);
+  }
+
+  /* 调试/自测钩子（线上留着也无害，方便需要时手动触发两种控件看一眼） */
+  window.__humanCheck = {
+    state: function () { return { hasPass: hasPass, busy: busy, events: events, honey: honey }; },
+    run: run, showClick: showClick, showCaptcha: showCaptcha, drop: dropWidget,
+  };
+
+  document.addEventListener('pjax:complete', function () { setTimeout(init, 300); });
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', init);
+  else init();
+})();
+</script>
 {{ end }}
\ No newline at end of file