--- title: "OraBot: user agent, token, block rate | Agent Ready Crawlers" description: "OraBot from Ora: exact user-agent string, robots.txt token OraBot, other purpose and how to verify it. Verification: Web Bot Auth. Read 2026-11-05." canonical: https://agentreadycrawlers.com/crawlers/orabot site: "Agent Ready Crawlers" last_updated: 2026-11-05 section: "Crawlers" --- # OraBot: user agent, token, block rate | Agent Ready Crawlers > OraBot from Ora: exact user-agent string, robots.txt token OraBot, other purpose and how to verify it. Verification: Web Bot Auth. Read 2026-11-05. Source: https://agentreadycrawlers.com/crawlers/orabot Site: Agent Ready Crawlers Last reviewed: 2026-11-05 Bot from Ora # OraBot (Ora's scanner) In short OraBot is the scanner Ora runs on demand to score a site, filed under Other. Ora says it signs every request with Web Bot Auth, so a site can check a signature against Ora's key directory. Ora's bot page says nothing about how OraBot treats robots.txt, and no site in the crawl names it. Operator Ora Purpose Other [All other rows](https://agentreadycrawlers.com/crawlers/purpose/other/). Link previews, ad checks, dataset crawls, SEO tools and legacy tokens that fit none of the five purposes. User-agent string `OraBot/1.0 (+https://ora.ai/bot)` robots.txt token `OraBot` Matched case-insensitively (RFC 9309). The token and the user-agent string are different things. Respects robots.txt No statement Ora's bot page does not say whether OraBot reads robots.txt rules before it fetches a page. It says a site owner can ask Ora to exclude a domain from scans, and that a verified owner can turn active probes off in Ora Studio. [Source](https://ora.ai/bot?utm_source=agentreadycrawlers.com&utm_medium=referral&utm_campaign=profile), read 2026-11-05. Verification Web Bot Auth signature Requests carry an HTTP message signature that can be checked against the operator's published key directory. [Documentation](https://ora.ai/.well-known/http-message-signatures-directory?utm_source=agentreadycrawlers.com&utm_medium=referral&utm_campaign=profile), read 2026-11-05. IP ranges Not published. Rate behaviour On demand, not on a schedule: a scan is a bounded burst of requests with hard timeouts and body-size caps. Ora limits its Personal Agent Protocol probes to one round per target domain every 6 hours and 7 requests per round. Block rate Not measured: the crawl checked 31 AI and search tokens, and `OraBot` is not one of them. Documentation [Ora's scanner bot page](https://ora.ai/bot?utm_source=agentreadycrawlers.com&utm_medium=referral&utm_campaign=profile), read 2026-11-05. ## Allow and refuse lines The operator documents no robots.txt lines for this token. Verify its signature in your WAF or edge rules instead, then allow or refuse the verified identity. Refusing or allowing in robots.txt states a preference. Enforcement of a refusal belongs in your WAF; see how to verify the identity above. ## Ora in the Verification Ledger Signs every OraBot request with Web Bot Auth; the key directory answered on 2026-11-05. [All operators](https://agentreadycrawlers.com/verification/). IP lists publishes nothing Reverse DNS publishes nothing Key directory https://ora.ai/.well-known/http-message-signatures-directory Cloudflare not checked Visa TAP registry not applicable: Ora's bot page describes a scanner that does not shop or pay (read 2026-11-05) Mastercard Agent Pay not applicable: Ora's bot page describes a scanner that does not shop or pay (read 2026-11-05) ## What a scan sends and how to check it Signed requests Ora says every request that carries the OraBot user agent is signed with HTTP Message Signatures (RFC 9421, the Web Bot Auth profile) using an Ed25519 key, and carries `Signature`, `Signature-Input` and `Signature-Agent` headers. It tells site owners to treat unsigned traffic on that user agent like any other unverified bot ([Ora's bot page](https://ora.ai/bot?utm_source=agentreadycrawlers.com&utm_medium=referral&utm_campaign=profile), read 2026-11-05). Key directory [ora.ai/.well-known/http-message-signatures-directory](https://ora.ai/.well-known/http-message-signatures-directory?utm_source=agentreadycrawlers.com&utm_medium=referral&utm_campaign=profile) answered 200 as `application/http-message-signatures-directory+json` on 2026-11-05 and lists one Ed25519 key, valid from 2026-08-27 to 2027-08-27. The directory is the one place a site can check a signature against; the user-agent string proves nothing, since anyone can copy it. Unsigned requests During a scan Ora also sends a handful of requests to the home page that carry other crawlers' user agents, such as GPTBot, ClaudeBot and PerplexityBot, and records how the site answers. Ora says these stay unsigned, because signing them as Ora would contradict the user agent they carry. A site that checks a claimed GPTBot against OpenAI's published addresses will see an address that is not OpenAI's. Personal Agent Protocol reads Every scan requests `/.well-known/poppy.json` on the scanned domain, and on its www or apex sibling when the host has none and its home page resolved to the sibling. Where that file lists them, OraBot also reads the issuer's RFC 8414 metadata and up to three each of other domains' `poppy.json` files, OpenAPI documents and MCP servers' RFC 9728 metadata. Junk-request probes to the endpoints the file lists run only when the scan asks for them. Ora says its scan page and report rescans ask, and that its MCP tools, scheduled jobs and bulk scans never do. Limits Ora states One probe round per target domain every 6 hours, at most 7 requests in a round and a 10 second budget for all of that work in one scan. A scan is on demand, not scheduled. Turning it off Ora says a verified owner can turn active probes off in Ora Studio, and that anyone else can write to the contact address on its bot page, after which Ora stops them for the domain or excludes the domain from scans. The page names no robots.txt route. What the crawl shows None of the 8,624 robots.txt files the crawl parsed names OraBot, so a site in the crawl can refuse it only through a \* group that refuses everything. For scale, 245 of 5,938 top-10,000 sites, 4.1 percent, refuse the crawl's own control token through a \* group alone (crawl of 2026-11-04). The crawl did not measure OraBot as a token of its own. The ora-scanner row in [the Block Rate Report](https://agentreadycrawlers.com/block-rates/) is a control name that is not Ora's user agent, and says nothing about OraBot. ## Sources - [Ora's scanner bot page (vendor)](https://ora.ai/bot?utm_source=agentreadycrawlers.com&utm_medium=referral&utm_campaign=profile) read 2026-11-05 - [Ora's key directory (vendor)](https://ora.ai/.well-known/http-message-signatures-directory?utm_source=agentreadycrawlers.com&utm_medium=referral&utm_campaign=profile) read 2026-11-05 Last reviewed 2026-11-05