---
title: "Verify who an agent is · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/hostile-agents-and-bots/verify-agent-identity
updated: 2026-10-20
licence: "All rights reserved"
---

# Verify who an agent is

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Hostile agents and bots](https://agentwranglers.se/playbook/adversarial-testing/hostile-agents-and-bots)
- Rule: Never trust the user agent string. Give special access to a bot or agent only after it proves who it is.
- How: Check signed requests where the agent offers them, such as HTTP message signatures in the style of Web Bot Auth. For known crawlers, match the address against the IP ranges the operator publishes. Or confirm it with a reverse DNS lookup and a forward lookup that matches. Treat every other request as an ordinary visitor. To sign your own agent's requests, see [Web Bot Auth](https://agentwranglers.se/playbook/website/ready-for-ai-agents/web-bot-auth).
- Check: Send a request with a well-known crawler's user agent from a test machine. It gets no more access than a normal visitor.

Example:

```sh
host 66.249.66.1          # crawl-66-249-66-1.googlebot.com
host crawl-66-249-66-1.googlebot.com   # must return 66.249.66.1
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/hostile-agents-and-bots/verify-agent-identity`.

- Next: [Limit bulk reads and scraping](https://agentwranglers.se/playbook/adversarial-testing/hostile-agents-and-bots/limit-bulk-reads)
- [Hostile agents and bots](https://agentwranglers.se/playbook/adversarial-testing/hostile-agents-and-bots)