Google Launches Experimental Web Bot Auth to Cryptographically Verify Automated Traffic

Google has introduced an experimental protocol called Web Bot Auth that allows websites to cryptographically verify the identity of automated clients. The system builds on the HTTP Message Signatures standard (RFC 9421) and requires bots to publish a public key in a JSON Web Key Set (JWKS) file located under the well‑known directory (/.well‑known/). When a bot sends a request, it includes a Signature‑Agent header that points to the key’s location, enabling the server to validate the signature against the public key and confirm the bot’s identity. Google’s own agents, such as the Google‑Agent fetcher, already sign requests with a header g="https://agent.bot.goog" and expose their keys in the same directory, demonstrating the protocol in action.

The new protocol is designed to complement, not replace, existing bot‑detection techniques. Sites can still rely on IP range checks, reverse DNS lookups, and user‑agent strings while Web Bot Auth rolls out gradually. Cloudflare and other Web Application Firewalls (WAFs) already support the protocol, and the IETF draft is a joint effort by Cloudflare and Google, with a working group chartered for early 2026. For site owners who use a CDN or WAF that supports Web Bot Auth, verification may happen automatically; otherwise, they must manage the keys themselves. Google advises that no immediate action is required unless a site chooses to adopt the new layer of security.

Because the protocol is still experimental, Google recommends treating it as a supplementary verification method. Site owners are encouraged to contact their hosting providers to confirm support and to provide feedback through the official Web Bot Auth feedback form. The goal of the initiative is to reduce bot impersonation by making it harder for malicious actors to spoof legitimate automated traffic. As the standard evolves, Google will continue to refine the implementation and expand the set of bots that sign every request.