AWS WAF deployed Web Bot Authentication on November 21, using HTTP Message Signatures (RFC 9421) for cryptographic verification. The protocol issues four verification labels, letting organizations whitelist verified bots while blocking impersonators.