33How can a website tell that a request really comes from a specific AI agent or crawler? Explain signed requests and Web Bot Auth.▼mediumNewCloudflareGoogleOpenAI◆ premiumA user agent string is a claim anyone can type. A signature over the request is a claim only the key holder can make. The interesting part is what that signature still does not tell the site.Open full answer →
44How does bot management decide a request is automated, and how would you protect a login or checkout from bots?▼mediumNewCloudflareAmazonShopify◆ premiumA bot can send exactly the headers a browser sends. It is much harder for it to send the same TLS handshake, run the same JavaScript and behave like a person. Bot management stacks those differences.Open full answer →