# Sites with a broken Web Bot Auth directory

A site-wide report: one row per host, over the web\_bot\_auth rows the crawl emitted.

## What this report returns

Web Bot Auth lets a site prove its outbound bots' identity: verifiers fetch the site's public keys from a JWKS directory at `/.well-known/http-message-signatures-directory` and check request signatures against them.

A row appears here when any of these is wrong, worst first:

-   **Malformed Directory**The served file isn't a conformant JWKS (invalid JSON, or its `"keys"` isn't an array per RFC 7517), so no keys can be read.**Fix** Serve `{"keys": [ ...JWKs... ]}` as valid JSON.
-   **Missing Keys**The JWKS is served but lists no keys, so there's nothing to verify signed bot requests against.**Fix** Publish the bot's public verification key(s) in the keys array.
-   **Invalid Key**Keys are listed but none carries usable public verification material for HTTP message signatures (Ed25519, EC P-256/P-384, or RSA with well-formed base64url params). A key whose material is sound but whose `"alg"` is mislabelled is NOT this defect: that is Unregistered Alg Name, and it is a one-word fix.**Fix** Publish a conformant public JWK, e.g. an OKP Ed25519 key with a valid base64url `"x"`.
-   **Test Key**The directory publishes one of RFC 9421's example keys, whose private half is printed in the RFC: verifiers that follow the draft reject your bots, and any that don't would accept forgeries from anyone. RFC 9421 allows these keys only for testing.**Fix** Generate a new key pair, publish only its public half, and sign with it.
-   **Wrong Media Type**The directory isn't served with the draft's required media type (a missing `Content-Type` also fails), so strict verifiers reject the response.**Fix** Set `Content-Type: application/http-message-signatures-directory+json` on the response.
-   **Unregistered Alg Name**A key's material is fine, but its `"alg"` names no signature algorithm for that key (an encryption algorithm such as A128GCM, or another curve's name), so a verifier that honours alg cannot use it. Either spelling of the right algorithm is accepted, e.g. `"ed25519"` or `"Ed25519"` for an Ed25519 key.**Fix** Name the key's own algorithm, or leave alg out.

Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment.

## The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

-   Host`host`
-   Web Bot Auth Valid`webBotAuthValid`
-   Web Bot Auth Conformance Issue Detected`webBotAuthConformanceIssueDetected`
-   Web Bot Auth Security Risk Detected`webBotAuthSecurityRiskDetected`
-   Web Bot Auth Findings`webBotAuthFindings`
-   Web Bot Auth Key Types`webBotAuthKeyTypes`
-   Web Bot Auth Served Media Type`webBotAuthServedMediaType`
-   Web Bot Auth Malformed Directory`webBotAuthMalformedDirectory`
-   Web Bot Auth Missing Keys`webBotAuthMissingKeys`
-   Web Bot Auth Invalid Key`webBotAuthInvalidKey`
-   Web Bot Auth Private Key Exposed`webBotAuthPrivateKeyExposed`
-   Web Bot Auth Test Key`webBotAuthTestKey`
-   webBotAuth HTTPS Downgrade`webBotAuthInsecureRedirect`
-   Web Bot Auth Weak RSA Key`webBotAuthWeakRsaKey`
-   Web Bot Auth Wrong Media Type`webBotAuthWrongMediaType`
-   Web Bot Auth Unregistered Alg Name`webBotAuthUnregisteredAlgName`
-   Ruleset Version`rulesetVersion`
-   Security Check Status`securityCheckStatus`
-   Related Security Frameworks`securityFrameworkReferences`

## About Web Bot Auth directory

Public keys letting verified agents prove who they are.

[Read how Web Bot Auth directory is checked](https://agentic-readiness.lumar.io/docs/trust/web-bot-auth), including the specification it is validated against and a worked correct and broken example.

## Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. [See the whole set](https://agentic-readiness.lumar.io/scan-at-scale), or check a single URL with the [scanner on this site](https://agentic-readiness.lumar.io/), which runs the same code with no account.

[Get Lumar pricing →](https://www.lumar.io/pricing/)