Crawler provenance is the evidence that an automated bot really comes from the operator it claims to represent. A crawler can send any User-Agent string it wants, so the name alone is not proof. Provenance checks usually rely on verified IP ranges, reverse DNS, ASN ownership, TLS or application-level attestations, and published bot verification guidance.
This matters because attackers often impersonate trusted crawlers to bypass filters, gain access to protected content, or hide reconnaissance among normal traffic. If a site trusts a bot name without checking provenance, it may expose secrets, private files, or internal endpoints to untrusted scanners. Defenders use provenance to allow legitimate bots while blocking spoofed ones, and they should combine it with least-privilege access, rate limiting, and secret hygiene. In practice, crawler provenance turns bot identity from a claim into something that can be verified.