---
title: "Web Bot Auth: what it is and what we check · Specoria"
description: "Bots and agents sign their HTTP requests (HTTP Message Signatures, RFC 9421) so a site or CDN can verify who they are against published keys."
source_url: "https://specoria.com/agent-protocols/web-bot-auth/"
lang: "en"
---

AGENT PROTOCOL MAP Facts checked against their sources on October 8, 2026

# Web Bot Auth

Bots and agents sign their HTTP requests (HTTP Message Signatures, RFC 9421) so a site or CDN can verify who they are against published keys.

Web Bot Auth

## At a glance

### Who runs it
The IETF webbotauth working group; Cloudflare treats signed agents as verified bots, and Google is testing it for part of its Google-Agent traffic.

### Where it stands
An Internet-Draft (working-group draft of 1 September 2026), not yet an RFC. Cloudflare added a “signed agents” category in August 2025.

Source: [IETF webbotauth working group ↗](https://datatracker.ietf.org/group/webbotauth/documents/) · September 1, 2026

Source: [Cloudflare ↗](https://blog.cloudflare.com/signed-agents/) · August 28, 2025

### In Türkiye
Works at web level, with no country restrictions. Google describes its own use as experimental.

Source: [Google Search Central ↗](https://developers.google.com/crawling/docs/crawlers-fetchers/web-bot-auth) · May 4, 2026

Checked

## What our free test checks

Our free test: Checked

Reads /.well-known/http-message-signatures-directory and shows it if it lists keys. Most stores don’t need one: it matters for sites that run their own agents. Separately, the agent simulator’s browser runs on Cloudflare and identifies itself as Cloudflare’s signed bot.

Requests (GET only)

- `/.well-known/http-message-signatures-directory`

Shown in the result as

- Web Bot Auth key directory

Our rules

## How the test treats protocols

- None of these affects the score. Adoption is still very low, so a missing file is information, not a fault.
- Only GET requests to the store’s own domain, small and short. We never call an endpoint, open a session, send a POST or place an order.
- A file counts only if it is a valid JSON object of the expected shape; a soft 404 page doesn’t count.
- Every request is listed on our crawler page, and you can ask to have your site excluded.

[Every request our crawler makes →](https://specoria.com/bot/)

Agent protocol map

## Keep reading

### Related reading

[Bot or buyer? How shopping agents identify themselves to your store →](https://specoria.com/insights/bot-or-buyer-agent-identity/)

### Other protocols

[UCP](https://specoria.com/agent-protocols/ucp/) · [ACP](https://specoria.com/agent-protocols/acp/) · [MCP](https://specoria.com/agent-protocols/mcp/) · [WebMCP](https://specoria.com/agent-protocols/webmcp/) · [A2A](https://specoria.com/agent-protocols/a2a/) · [llms.txt](https://specoria.com/agent-protocols/llms-txt/)

[All eight protocols on one page →](https://specoria.com/agent-protocols/)

## Does your store publish Web Bot Auth?

The free test reads the files and signals on this page from your store, with GET requests only.

[Run the free test on your store →](https://specoria.com/#contact)[How the free test works →](https://specoria.com/method/)