We collaborated with industry partners to advance the IETF proposal for Web Bot Auth and Vercel's bot verification system supports the new protocol. Now, Bot Protection can use HTTP Message Signatures to verify traffic automation from dynamic and distributed sources.

Vercel maintains a comprehensive and actively curated directory of known bots that are verified by IP, reverse DNS, and now Web Bot Auth, which verifies bots via public-key cryptography in signed headers. This ensures that legitimate automation, like SEO crawlers, performance monitoring tools, and platform-integrated AI bots, can reliably access your site, while spoofed bots are blocked.

Web Bot Auth's asymmetric signature proves the authenticity of the traffic regardless of its network origin, making it ideal for bots running in dynamic or serverless environments.

Verified Bots using Web Bot Auth include signed headers to authenticate each request, allowing them to be recognized and allowed through Bot Protection and Challenge Mode. For example, ChatGPT operator signs its requests using Web Bot Auth, so is now allowed.

Learn more about Bot Management.