What is the difference between Content Signals Policy and Web Bot Auth HTTP Message Signatures?

They answer different questions: Content Signals Policy is a step 3 (Permit) standard, Web Bot Auth HTTP Message Signatures step 2 (Identify), so they are not substitutes. Content Signals Policy answers: May content fetched under a robots.txt allow rule also be used for search indexing, as live input to an AI answer, or for AI model training? Web Bot Auth HTTP Message Signatures answers: Which automated client made this HTTP request, and can the origin verify it cryptographically?

When should I use Content Signals Policy instead of Web Bot Auth HTTP Message Signatures?

Choose Content Signals Policy when your question is “May content fetched under a robots.txt allow rule also be used for search indexing, as live input to an AI answer, or for AI model training?” and you accept its maturity: phase living, adoption unmeasured. Choose Web Bot Auth HTTP Message Signatures when your question is “Which automated client made this HTTP request, and can the origin verify it cryptographically?” and you accept its maturity: phase working group, adoption observed (Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix).

Can Content Signals Policy and Web Bot Auth HTTP Message Signatures be used together?

Yes. Because Content Signals Policy operates at step 3 (Permit) and Web Bot Auth HTTP Message Signatures at step 2 (Identify), they address different lifecycle steps and can be combined in one stack.

Content Signals Policy vs Web Bot Auth HTTP Message Signatures

They answer different questions: Content Signals Policy is a step 3 (Permit) standard, Web Bot Auth HTTP Message Signatures step 2 (Identify), so they are not substitutes.

3 Permit Content Signals Policy · 2 Identify Web Bot Auth HTTP Message Signatures

	Content Signals Policy	Web Bot Auth HTTP Message Signatures WebBotAuth
Lifecycle step	3 Permit: What may the agent do here?	2 Identify: Who is this agent? Who is this site?
Answers	May content fetched under a robots.txt allow rule also be used for search indexing, as live input to an AI answer, or for AI model training?	Which automated client made this HTTP request, and can the origin verify it cryptographically?
Governed by	Cloudflare, developed with publisher/platform partners named in the announcement (e.g. Condé Nast, News/Media Alliance, Reddit, Pinterest, Quora, Yahoo)	IETF webbotauth Working Group (chartered; document adopted as a WG item 2026-09-01)
Status (issuer's words)	Vendor-published policy convention layered on robots.txt; not submitted to a standards body as of this verification	Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027
Phase	living	working group
Version	Announced 2025-09-24 (2025-09-24)	draft-ietf-webbotauth-httpsig-protocol-00, adopted by the webbotauth WG, 2026-09-01 (replaces the individual draft-meunier-webbotauth-httpsig-protocol, last revision -02 of 2026-08-18) (2026-09-01)
Form / transport	well-known file	HTTP header
Found at	/robots.txt	/.well-known/http-message-signatures-directory
Adoption	unmeasured	observed — Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix
Evidence	5 verified	6 verified
Primary use case	Control AI crawling and training use	Prove an agent's identity
Last verified	2026-10-22 (current)	2026-10-20 (current)
Specification	https://blog.cloudflare.com/content-signals-policy/	https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/

When to use which

Choose Content Signals Policy when your question is “May content fetched under a robots.txt allow rule also be used for search indexing, as live input to an AI answer, or for AI model training?” and you accept its maturity: phase living, adoption unmeasured.
Choose Web Bot Auth HTTP Message Signatures when your question is “Which automated client made this HTTP request, and can the origin verify it cryptographically?” and you accept its maturity: phase working group, adoption observed (Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix).

Guidance is derived from the two records (question, phase, adoption, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.

Read the full articles

Content Signals Policy: May content fetched under a robots.txt allow rule also be used for search indexing, as live input to an AI answer, or for AI model training?
Web Bot Auth HTTP Message Signatures: Which automated client made this HTTP request, and can the origin verify it cryptographically?

Ask the MCP server to compare any two: the compare-protocols prompt, or get on both ids. Connect.

cloudflare-content-signals-policy.json · webbotauth.json · Markdown