Who runs it
The IETF webbotauth working group; Cloudflare treats signed agents as verified bots, and Google is testing it for part of its Google-Agent traffic.
Web Bot Auth
Bots and agents sign their HTTP requests (HTTP Message Signatures, RFC 9421) so a site or CDN can verify who they are against published keys.
Web Bot Auth
At a glance
Where it stands
An Internet-Draft (working-group draft of 1 September 2026), not yet an RFC. Cloudflare added a “signed agents” category in August 2025.
Source: IETF webbotauth working group ↗ ·
Source: Cloudflare ↗ ·
In Türkiye
Works at web level, with no country restrictions. Google describes its own use as experimental.
Source: Google Search Central ↗ ·
Checked
What our free test checks
Our free test: Checked
Reads /.well-known/http-message-signatures-directory and shows it if it lists keys. Most stores don’t need one: it matters for sites that run their own agents. Separately, the agent simulator’s browser runs on Cloudflare and identifies itself as Cloudflare’s signed bot.
Requests (GET only)
/.well-known/http-message-signatures-directory
Shown in the result as
- Web Bot Auth key directory
Our rules
How the test treats protocols
- None of these affects the score. Adoption is still very low, so a missing file is information, not a fault.
- Only GET requests to the store’s own domain, small and short. We never call an endpoint, open a session, send a POST or place an order.
- A file counts only if it is a valid JSON object of the expected shape; a soft 404 page doesn’t count.
- Every request is listed on our crawler page, and you can ask to have your site excluded.
Agent protocol map
Keep reading
Does your store publish Web Bot Auth?
The free test reads the files and signals on this page from your store, with GET requests only.