Verifying agents and bots: telling a real agent from a borrowed name
Anyone can call their script GPTBot. Verification is how you tell.
Am I Ready for Agents? editors · 16 September 2026 · Reviewed September 2026
A user agent name is a label any script can copy. Platforms verify bots in three ways: published IP ranges, reverse DNS and cryptographic signatures with Web Bot Auth. Verification is what lets you welcome known agents at checkout or booking without opening the door to every script that borrows their names.
Why is a name not enough?
Every automated visitor announces a name, its user agent, such as GPTBot, ClaudeBot or Google-Agent. Your robots.txt and bot rules use those names. But the name is only text in the request, and nothing stops a scraper from sending the same text. If your rules trust names alone, allowing a well-known agent also allows anything that claims to be it.
How do platforms verify a bot?
- IP ranges: checking that the request comes from addresses the operator publishes.
- Reverse DNS: checking that the request's IP address resolves back to a domain the operator controls.
- Web Bot Auth: the bot signs each request and the site checks the signature. It is built on HTTP Message Signatures, RFC 9421, published in February 2024.
Vercel lists these three methods in its bot management documentation. Signatures are the newest, and copying a bot's name does not copy its signature.
Who does the verifying?
Usually your CDN or host, not your web team directly. Vercel's verified bots directory lists operators by name and category, and its BotID fields let a site's code see whether a request comes from a verified bot, with the bot's name and category. Vercel's documentation shows an example that lets the verified ChatGPT operator through while refusing other bots.
Cloudflare runs a similar directory. Since 28 August 2026, operators submit bots through a BotBase dashboard and Cloudflare validates verification methods such as Web Bot Auth signatures automatically.
What does verification let a business do?
It turns an all-or-nothing choice into a policy. A store can let verified shopping agents reach checkout and apply its normal fraud rules to the purchase itself. A booking site can keep challenges for visitors it cannot identify. A publisher can check that a crawler claiming to be a search bot really is one before deciding what it may read.
Verification says who operates the bot. It does not say whether the person behind the agent is a good customer; that stays a job for your fraud and payments rules, which the next lesson covers.
What should you ask?
From the trust group on ask your web team: can we tell verified bots, for example ones that sign requests with Web Bot Auth, from bots that only claim a name, and does our bot protection use a verified bot directory. Self-check question 16 asks the same thing in one line.