Skip to content
Sign in

SAFE-102Beside the path

Signed vs unsigned differentiation

Would check whether your site treats a cryptographically signed agent request differently from an unsigned one. This probe is deferred and currently always skipped, so it never affects your score.

What we check

This probe would send a request signed with Web Bot Auth beside an unsigned one and compare how each is treated. It is the positive counterpart to SAFE-101. Running it needs our own signing key published at a /.well-known/http-message-signatures-directory, which we have not yet provisioned. Until we have both, the probe sends no request and reports SKIPPED instead of guessing a result.

Why it matters

Signing requests is an emerging way for an agent to prove it is genuine and not a scraper using an agent's name. A site that can tell signed from unsigned traffic can let verified agents in and keep impostors out. We report this check as not yet measured instead of inventing a verdict.

How we check

The probe returns SKIPPED with the reason SIGNING_NOT_CONFIGURED and makes no network request. Because its score is null, it is renormalised out of the Safe (VERIFY) stage and neither helps nor hurts your score. When we provision a Web Bot Auth signing key, this page will describe the live method.

How to fix it

  1. There is nothing for you to fix here today. The check depends on a capability we have not yet enabled on our side.
  2. To prepare for signed-agent traffic in general, adopt Web Bot Auth on your side (see VER-002) so you can verify signatures when agents send them.

What good looks like

Deferred: no result is produced yet.

When enabled, a passing shop would treat a validly signed Web Bot Auth request more permissively than an identical unsigned one, for example by serving the signed agent while challenging the unsigned copy.

Sources

Read more

  • Bots, crawlers and agents: who is knocking

    A User-Agent string can be spoofed, and robots.txt rules are a request to crawlers rather than access authorization. Web Bot Auth, an IETF draft, would let an agent sign its requests so a server can verify who sent them.

Could an agent buy from your store?

The free scan runs all 51 checks on your store in about five minutes.

Scan my store
The storewalk.ai app on a phone, scanning a clothing store: it checks a product, views its details and compares options.