Forget IPs: using cryptography to verify bot and agent traffic

Cloudflare proposes standards-based mechanisms to authenticate legitimate bots and AI agents—focusing on HTTP Message Signatures (RFC 9421) and an experimental request mTLS signaled via TLS Flags—to supersede spoofable User-Agent headers and brittle IP-based verification. The post details how to generate and validate signatures, offers example implementations (browser extension hooks, Cloudflare Workers, Go/Caddy), discusses performance and key discovery considerations, and invites industry participation and beta testing as they pursue IETF standardization to help site owners reliably identify and control automated traffic.