Web Bot Auth

What it checks

A User-Agent header is easy to fake. Web Bot Auth lets an agent sign its requests with HTTP Message Signatures so a site can confirm who sent them.

The extension looks for a non-empty /.well-known/http-message-signatures-directory. Failing that, it checks the homepage response for a Signature-Agent or Accept-Signature header, which some servers use to advertise signature support.

Results

Status	When
Pass	A signatures directory is published, or the homepage sends Signature-Agent or Accept-Signature
N/A	Neither was found

How to fix

If you operate an agent, publish your signing keys as a JSON Web Key Set at /.well-known/http-message-signatures-directory, served with Content-Type: application/http-message-signatures-directory+json:

{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "<base64url public key>"
    }
  ]
}

If you run a site and want to verify signed agents, most sites get this from their CDN or bot-management provider rather than building it themselves.

Support by agent and browser

Announced means the vendor’s own docs or announcement say so. Published is the date on the vendor’s own page, where it has one. Checked is the last time our weekly research found that page still saying so.

Agent	Status	Source
AI assistants
ChatGPT OpenAI	Supported (announced)	OpenAI Help: ChatGPT Work's Cloud browser allowlisting Published 1 Aug 2026 · Checked 9 Oct 2026The Cloud browser (formerly the ChatGPT agent) signs requests per RFC 9421 with Signature-Agent "https://chatgpt.com". The keys are at https://chatgpt.com/.well-known/http-message-signatures-directory (verified live). The page shows only 'Updated: 2 months ago', so the date is the month only. Cloudflare listed ChatGPT agent in its first signed-agents cohort on 2025-08-28.
Gemini Google	Partial support	partial Google: Authenticate requests with Web Bot Auth (experimental) Published 4 May 2026 · Checked 9 Oct 2026Experimental: 'A subset of requests made by the Google-Agent are signed', with Signature-Agent g="https://agent.bot.goog" (directory verified live). Google-Agent is described as being 'used by agents hosted on Google infrastructure'; Google does not name Gemini as the product.

No evidence yet25

• Claude
• Perplexity
• Copilot
• Meta AI
• ChatGPT Atlas
• Comet
• Dia
• Gemini in Chrome
• Edge Copilot Mode
• Claude Code
• Cursor
• Codex
• GitHub Copilot
• Windsurf
• CCBot
• Applebot
• Amazonbot
• Bytespider
• Cohere
• Mistral
• DuckAssist
• Chrome
• Edge
• Firefox
• Safari

Names and marks belong to their owners and are used only to identify products. None of these vendors is affiliated with Sitebulb. Spotted something out of date? Send a correction.

Adoption on the top 100 sites

13%

13 of 100 measured sites implement it

Scanned 23 Oct 2026 with the Sitebulb Labs extension, against the Tranco list (tranco-56Z8N).

Sites implementing it13

1. #13 instagram.com
2. #16 x.com (via twitter.com)
3. #43 netflix.com
4. #52 uk.pinterest.com (via pinterest.com)
5. #57 cloudflare.net
6. #63 tiktok.com
7. #87 qq.com
8. #106 sentry.io
9. #112 chatgpt.com
10. #119 nic.ru
11. #136 developer.adobe.com (via adobe.io)
12. #147 reg.ru
13. #160 tumblr.com

Overview

5/9

Gaining traction

Real support exists and adoption is growing.

How this rating is worked out5 of 9 points

Factor	Points	Why
Vendor support	1 / 3	1 vendor supporting, 1 partly or planned
Top-100 adoption	2 / 3	13% of measured sites
Spec maturity	2 / 3	Standards-track draft

8 or more points is Established, 5 to 7 is Gaining traction, 2 to 4 is Speculative and under 2 is Stalled. A feature is also Stalled when more vendors have said no than yes. Read the spec.

Community insights

No community insights for this feature yet.

Quotes are from public posts, checked against the original before they appear here. Suggest an insight, or ask for yours to be removed.