Message Signatures are now part of our Verified Bots Program, simplifying bot authentication
Jul 1, 2025Mari Galicer, Akshat Mahajan, Gauri Baraskar, Helen Du
Summary
This post announces the integration of HTTP Message Signatures into Cloudflare's Verified Bots Program. It details how bots can use Message Signatures for faster enrollment and how Cloudflare verifies these signatures at the edge to identify authenticated bot traffic. It also introduces open-source libraries for generating these signatures and outlines the steps for bot operators to register their bots using this new method. The post explains the verification process for origins and highlights the benefits for site owners in managing bot traffic.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack