Web Bot Auth Checker

Check for the signature-verification key directory that lets a site verify bot identity.

Web Bot Auth is an IETF draft for cryptographically proving which bot sent a request, using HTTP Message Signatures and a key directory at /.well-known/http-message-signatures-directory. This check looks for that directory. The draft is very early, so almost no site publishes one yet.

This is one of the checks the AI Agent Readiness Checker scores under Bot Access Control, and it can also be run on its own for any URL.

Experimental · Based on: IETF Internet-Draft — HTTP Message Signatures for Automated Traffic (Web Bot Auth)

About this validation

Experimental / emerging convention

Checks for the HTTP Message Signatures key directory that would let a site cryptographically verify a bot's identity. Based on an active IETF Internet-Draft, not a ratified standard.

Reference documentation:: IETF Internet-Draft — HTTP Message Signatures for Automated Traffic (Web Bot Auth)(draft, not yet ratified)
Rules reviewed:: Nov 11, 2026

Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.