Message Signatures are now part of our Verified Bots Program, simplifying bot authentication

Cloudflare announces integration of HTTP Message Signatures (aligned with RFC 9421 and the Web Bot Auth draft) into its Verified Bots program, providing open-source libraries, streamlined enrollment, and automatic edge-side verification so authenticated bots are reliably identified without brittle IP/user-agent checks. Site owners can leverage verified bot fields and categories in WAF and rate-limiting rules to precisely allow trusted automated traffic and reduce spoofing and replay risks across the network.