Free tool · no signup · runs now
Web-Bot-Auth checker
Bots prove who they are with signed directories of keys. The checker verifies the same directory the audit requires.
Part of the Robots.txt checker & llms.txt checker group — also included in the free full scan.
Checks site-wide files at the domain root — any page URL on the domain gives the same result.
One free scan · anonymous preview · sign in to save the full report
1 Ed25519 keys, directory self-signedStatic example for Web-Bot-Auth checker; run the check above for your own result.What it checks
See whether bots can prove their identity with your published keys.
Directory content type, Ed25519 JWKS keys, self-signed Signature headers.
Reads the raw JSON only, never renders. Follows up to 5 redirects.
What good looks like
Good looks like Ed25519 keys in a directory signed with its own key — keyid matching the JWK thumbprint. A reachable but unsigned directory, a mismatched keyid or an expired signature fails; a missing file reports na.
How to fix it
The directory is reachable but incomplete: publish Ed25519 keys and sign the response with Signature + Signature-Input (keyid = JWK thumbprint, tag = http-message-signatures-directory).
What the full scan adds
- All 34 checks in one pass — one URL, every category, a single report.
- Evidence on every row: the values found, why it fails, the fix, and a deep link per check.
- Your score against the global distribution — see where you stand.
- Sign in and the report is kept for 1 year; anonymous reports expire after 7 days.
Official source: Cloudflare, Web-Bot-Auth · Rule: agent-readiness v1 · checker library
Tracking a Google update? Run the update impact check or read the search update radar.
Frequently asked questions
Is the Web-Bot-Auth checker free?
Yes — one free run without an account, with an anonymous preview. Sign in to save the full report and keep the evidence.
How often should I run it?
After every deploy that touches routing, templates or the checked file — and after each Google core update, to confirm nothing regressed.
Does the check run JavaScript?
No — it reads the no-JS response only, exactly what a crawler or AI agent sees when it fetches the URL.
How is this different from a full audit?
This page runs one check with its full criteria and fix notes. The free full scan runs every category at once and keeps the evidence per URL — use it once you know which checks matter.