Web Bot Auth directory exists

agent_bot_web_bot_auth

Checks if the site publishes a Web Bot Auth JWKS directory for request signing.

What does this rule check?

Web Bot Auth allows your site to cryptographically identify itself when sending bot or agent requests. By publishing a JWKS (JSON Web Key Set) at /.well-known/http-message-signatures-directory, receiving sites can verify your bot's identity.

Why is this important?

Without Web Bot Auth, your automated requests cannot be cryptographically verified by receiving sites. This limits trust and may result in your bot being blocked or rate-limited.

How to fix

Publish a JWKS at /.well-known/http-message-signatures-directory so your site can identify itself when it sends bot or agent requests.

Examples

GET /.well-known/http-message-signatures-directory

HTTP/1.1 404 Not Found

GET /.well-known/http-message-signatures-directory

HTTP/1.1 200 OK
Content-Type: application/json

{"keys": [{"kty": "RSA", "kid": "bot-1", ...}]}

Agent fix snippet

Copy this snippet and paste it into your AI coding agent to fix this issue automatically.

Publish a JWKS at /.well-known/http-message-signatures-directory:

{"keys": [{"kty": "RSA", "kid": "bot-signing-key", "use": "sig", ...}]}