Bot Access Control
Web Bot Auth
Web Bot Auth lets a bot cryptographically sign its requests, so a receiving site can tell a legitimate agent from a scraper pretending to be one.
Why it matters
This one is informational: publishing a key directory means "we sign our outbound requests". If you do not sign, publishing it would be a lie.
Pass criteria
A JWKS is published at /.well-known/http-message-signatures-directory.
What the scanner records
Every request the check makes is recorded (URL, method, response status, relevant headers and a body preview) and shown under the check in your results.
Every request the check makes is recorded (URL, method, response status, relevant headers and a body preview) and shown under the check in your results.
How to implement it
Let your site identify itself as a bot with Web Bot Auth
A JWKS is published at /.well-known/http-message-signatures-directory.
The step-by-step implementation prompt is part of the Pro plan.
See plansScan your site
See whether this check passes on your domain, along with the other 21.