B2B SaaS with no signal of agent-traffic differentiation (Signature-Agent header, agent-access policy)
This check looks for whether your site can tell the difference between human visitors and AI agents, for example by parsing the 'Signature-Agent' header (a piece of information some AI browsers send to identify themselves) or having a stated agent-access policy. This B2B SaaS site showed no such signal.
Why this matters
Some AI agent browsers present as a standard Chrome browser, so a signed Signature-Agent header (an emerging, still-evolving convention) is one way a site can tell agent traffic from human visitors. Without any such distinction, agents and people hit the same rate limits and pricing, so you cannot apply different rules to agent traffic. Whether you need to depends on how much agent traffic you actually receive.
How to fix it
Your engineering team should detect the Signature-Agent header in your edge layer (the part of your infrastructure that handles requests first) and apply different rate limits, pricing tiers, or content surfaces to agent traffic. Consider an agent-only API tier if agent usage grows. Budget around a week to build and test this.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit