What Is ChatGPT-User? OpenAI's User Agent Explained (vs OAI-SearchBot and GPTBot)

ChatGPT-User is the user agent OpenAI sends when a person using ChatGPT, a custom GPT or a GPT Action needs a web page right now. It is not a crawler in the usual sense: OpenAI says it "is not used for crawling the web in an automatic fashion", and it is not what decides whether you appear in ChatGPT search. That job belongs to OAI-SearchBot.

Mixing the two up is one of the most common and costly robots.txt mistakes in AI SEO. This guide explains what each OpenAI agent does, what OpenAI says about robots.txt for each one, how to verify real requests, and how to measure the traffic ChatGPT sends you. It uses OpenAI's own documentation and our study of the top 10,000 sites. To see how your site treats all four OpenAI agents today, run the free AI crawler checker.

The ChatGPT-User user-agent token

The robots.txt token is ChatGPT-User. OpenAI publishes the full user agent string:

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot

OpenAI also publishes the IP addresses it uses for ChatGPT-User at https://openai.com/chatgpt-user.json. That list is how you tell a real request from a fake one, because anyone can copy a user agent string. Our ChatGPT-User profile keeps the token details on one page.

OpenAI describes the agent this way: "When users ask ChatGPT or a CustomGPT a question, it may visit a web page with a ChatGPT-User agent. ChatGPT users may also interact with external applications via GPT Actions." In plain terms, a ChatGPT-User request in your logs means a person was waiting for an answer that needed your page.

The OpenAI crawler family: four agents, four jobs

OpenAI now documents four agents. Each has its own robots.txt token, its own user agent string and its own IP list. OpenAI says: "Each setting is independent of the others."

Two details on OpenAI's page are easy to miss. First, "if your site has allowed both bots, we may use the results from just one crawl for both use cases to avoid duplicative crawling", meaning OAI-SearchBot and GPTBot may share a fetch. Second, OAI-AdsBot "only visits pages submitted as ads, and the data collected by OAI-AdsBot is not used to train generative AI foundation models". If you do not advertise on ChatGPT, you will not see it.

Does ChatGPT-User respect robots.txt?

Not reliably, and OpenAI says so. Its exact words: "Because these actions are initiated by a user, robots.txt rules may not apply." OpenAI also says ChatGPT-User "is not used to determine whether content may appear in Search. Please use OAI-SearchBot in robots.txt for managing Search opt outs and automatic crawl."

That puts ChatGPT-User in the same group as other user-triggered fetchers. Perplexity says its Perplexity-User fetcher "generally ignores robots.txt rules" because "a user requested the fetch" (Perplexity). Google says its own user-triggered fetchers "ignore robots.txt rules" for the same reason. Anthropic is the exception: it lists Claude-User as a robots.txt control.

Many sites have not caught up. In our study, 287 files (5.8%) block ChatGPT-User in its own robots.txt group. That line states a preference. If you need an actual block, you need a firewall rule.

ChatGPT-User vs OAI-SearchBot: which one gets you cited

If your goal is to appear in ChatGPT answers with a link, OAI-SearchBot is the one that matters (our OAI-SearchBot guide covers it in depth). OpenAI says: "To help ensure your site appears in search results, we recommend allowing OAI-SearchBot in your site's robots.txt file and allowing requests from our published IP ranges." And: "Sites that are opted out of OAI-SearchBot will not be shown in ChatGPT search answers, though can still appear as navigational links."

Our data shows the mix-up is common. Of 710 top sites that block GPTBot, 363 also block OAI-SearchBot. Some chose that on purpose. Many copied a single "block AI" list and removed themselves from ChatGPT search without meaning to.

User-agent: OAI-SearchBot
User-agent: ChatGPT-User
Allow: /

User-agent: GPTBot
Disallow: /

User-agent: *
Allow: /

OpenAI says that for search results, "it can take ~24 hours from a site's robots.txt update for our systems to adjust". Do not judge a change by what ChatGPT says the same afternoon.

How ChatGPT-User works when someone asks about your page

1. A person asks ChatGPT a question, pastes your URL, or uses a custom GPT or GPT Action that needs live data.
2. ChatGPT decides it needs a page. It may already know the URL from its search index, which OAI-SearchBot built.
3. ChatGPT-User fetches the page from an IP on OpenAI's published list, with the user agent shown above.
4. ChatGPT reads the response and uses it in the answer, often with a link back to you.
5. If the person clicks, they arrive with utm_source=chatgpt.com on the URL.

It also explains why ChatGPT-User traffic is bursty. A crawler such as OAI-SearchBot works through a queue at a steady pace. ChatGPT-User arrives when people ask questions, so a page that suddenly becomes relevant, for example after a news story or a product launch, can see many fetches in a short time and then none. Do not rate limit it as if it were a crawler; each request is a person waiting.

One practical consequence: content that only appears after JavaScript runs may never be seen. Vercel and MERJ measured OpenAI's crawlers across Vercel's network and found that OAI-SearchBot, ChatGPT-User and GPTBot all fetch JavaScript files but do not execute them (Vercel and MERJ). Put your main text, prices and key facts in the HTML the server sends.

ChatGPT agent and the Cloud browser are different again

ChatGPT also has agent features that browse in a real browser, which is not the same as ChatGPT-User. For the Cloud browser in ChatGPT Work, OpenAI says it "uses Web Bot Auth to sign outbound HTTP requests", following the HTTP Message Signatures standard, RFC 9421 (OpenAI Help). Each request carries Signature, Signature-Input and a Signature-Agent header set to "https://chatgpt.com".

OpenAI publishes the public keys at https://chatgpt.com/.well-known/http-message-signatures-directory. Cloudflare, Akamai, HUMAN and Vercel verify these signatures automatically; on Cloudflare the agent appears with the bot tag chatgpt-agent. Signatures are much harder to fake than a user agent, so if you allow AI agents on purpose, allow them by verified signature, not by string.

For the ChatGPT Atlas browser, OpenAI says it uses ARIA labels and roles "to interpret page structure and interactive elements", and recommends WAI-ARIA best practices for buttons, menus and forms (OpenAI publishers FAQ). Our guide to making a site work for AI agents and the AI Agent Readiness Check cover that side.

How to verify a real ChatGPT-User request

Fake OpenAI user agents are common, because some scrapers hope you allow them. A real ChatGPT-User request comes from an IP address in OpenAI's published list. Check both the string and the IP.

grep "ChatGPT-User" /var/log/nginx/access.log \
  | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

import ipaddress, json, urllib.request
data = json.load(urllib.request.urlopen("https://openai.com/chatgpt-user.json"))
nets = [ipaddress.ip_network(p.get("ipv4Prefix") or p.get("ipv6Prefix"))
        for p in data.get("prefixes", [])]
ip = ipaddress.ip_address("203.0.113.10")   # replace with an IP from your log
print(any(ip in n for n in nets))

If an IP claims ChatGPT-User but is not on the list, treat it as an impostor. You can block it without affecting ChatGPT. Repeat the check every so often, because OpenAI updates the lists. The same method works for OAI-SearchBot and GPTBot with their own JSON files.

What OpenAI's IP lists looked like on 5 October 2026

We downloaded all four OpenAI lists on the day we updated this guide. The sizes tell you something about each agent: ChatGPT-User works for millions of people at once, so it uses far more address blocks than the crawlers.

None of the four lists contained IPv6 prefixes that day. The ChatGPT-User list changed within the last two weeks, which is why a firewall rule copied once and never refreshed will drift. Automate the download, or let a CDN that tracks OpenAI's lists do it for you.

OpenAI also says that when fetching robots.txt it may add a robots.txt marker to the user agent "to help site owners distinguish those requests from requests for other resources, especially when logs do not include paths". If you see that marker, the request was for your rules file, not a page.

Tracking the traffic ChatGPT sends you

This is the part most sites get wrong, because they look for ChatGPT-User in Google Analytics. Bots do not appear there: GA4 automatically excludes known bots and spiders, and you cannot turn that off (Google Analytics Help). What you can see is the people who click.

OpenAI says: "ChatGPT automatically includes the UTM parameter utm_source=chatgpt.com in referral URLs, enabling clear tracking and analysis of inbound traffic from ChatGPT search results" (OpenAI publishers FAQ).

1. In GA4, open Reports, then Acquisition, then Traffic acquisition.
2. Change the primary dimension to Session source.
3. Search for chatgpt.com. You will usually see it with medium referral or with the UTM value.
4. Add Landing page as a secondary dimension to see which pages ChatGPT sends people to.
5. Compare those pages with the pages ChatGPT-User fetches in your server logs.

The gap between fetches and visits is normal. Cloudflare's data for July 2025 showed OpenAI crawling about 1,091 pages for every visitor it referred (Cloudflare, August 2025). Our guide to monitoring AI bot traffic shows how to put both numbers side by side.

Pages blocked in robots.txt can still show up as links

OpenAI's publishers FAQ adds an important detail for its Atlas browser: "if we obtain the URL of a disallowed page from a third-party search provider or by crawling other pages and have signals the page is relevant to a user's query, we may surface just the link and page title in ChatGPT Atlas." If you do not want that, OpenAI says to use the noindex meta tag, and notes that "in order for our crawler to read a meta tag, it must be allowed to crawl the relevant page(s)."

This is the same logic Google uses: robots.txt stops reading, not listing. To keep a page out of answers entirely, allow crawling and add noindex.

ChatGPT-User vs Claude-User vs Perplexity-User

Every major assistant now has a "fetch for one user" agent. They look alike in your logs, but the companies describe their robots.txt behavior differently, and that changes what your rules can do.

In our study, the three are blocked by name at similar low rates: ChatGPT-User in 287 files, Claude-User in 190 and Perplexity-User in 201. Most sites that block them do it with one shared line, without noticing that only Anthropic says the line will be followed.

Our advice is the same for all three: allow them unless you have a business reason not to. They only arrive when a real person asked about your page, and they are often the step right before that person clicks through to you.

Common problems and fixes

The last row matters more every month. Cloudflare's July 2026 update named chat fetch bots such as ChatGPT-User as "Agent" traffic and set new domains to block Agent and Training traffic by default on pages that show ads (Cloudflare, 1 July 2026). If ChatGPT cannot open your pages and your robots.txt looks fine, start there. The AI crawler diagnostic fetches a page as each OpenAI agent and shows which layer answers.

Optimizing pages for ChatGPT answers

OpenAI does not publish ranking factors for ChatGPT search, so be wary of anyone who claims to know them. What OpenAI does say is that any public site can appear, and that OAI-SearchBot must not be blocked. Beyond that, the safest advice is the advice that helps every reader:

• Answer the question in the first paragraph. A person sent ChatGPT to your page for a reason; make the answer easy to find.
• Put facts in text, not images. Prices, specs, dates and names should be readable in the HTML.
• Show who wrote it and when. Visible authors, dates and sources help readers and any system that weighs trust.
• Use descriptive headings and tables. They make a page easier to quote correctly.
• Keep URLs stable. Vercel and MERJ found OpenAI's crawler spent 34.82% of its fetches on 404 pages, so broken links waste its visits.

For a fuller method, see our E-E-A-T for AI search guide.

Checklist for OpenAI agents

• □OAI-SearchBot is allowed in robots.txt and its IPs are allowed at your CDN.
• □GPTBot is set the way you want for training, in its own group.
• □You have not relied on robots.txt to block ChatGPT-User.
• □Your firewall allows OpenAI's published ChatGPT-User IPs, or you made a deliberate choice not to.
• □Main content is in the server HTML, not only in JavaScript.
• □GA4 shows a chatgpt.com segment you review monthly.
• □You re-ran the AI crawler checker after each change.

Sources and further reading

Every claim above links to the page it came from. These are the primary sources, all read or re-read on 5 October 2026. Where we give a figure from our own data, it comes from our robots.txt study of the top 10,000 sites, and the raw counts are in the downloadable CSV.

1. OpenAI: Overview of OpenAI crawlers
2. OpenAI Help: Publishers and developers FAQ
3. OpenAI Help: ChatGPT Work's Cloud browser allowlisting (Web Bot Auth)
4. Perplexity: Perplexity crawlers
5. Anthropic: Does Anthropic crawl data from the web? (7 April 2026)
6. Vercel and MERJ: The rise of the AI crawler (December 2024)
7. Google Analytics Help: Known bot-traffic exclusion
8. Cloudflare: The crawl-to-click gap (29 August 2025)
9. Cloudflare: Content Independence Day, new AI options (1 July 2026)
10. Tranco: a research-oriented top sites ranking