Safe Official docs AI & LLM Bots

GPTBot

Q: What is the official user-agent string for GPTBot?

The official user-agent string for GPTBot is: GPTBot . This is the exact string you must use in robots.txt, Nginx, Apache, or Cloudflare firewall rules to target this bot. User-agent matching in robots.txt is case-insensitive, but the string must be spelled correctly. You can verify that a request genuinely comes from GPTBot by performing a reverse-DNS lookup on the source IP - legitimate bots resolve back to their operator's domain.

Q: Is GPTBot safe?

Yes. GPTBot is a documented bot: OpenAI publishes a page that names it and explains what it does.

Q: How do I block GPTBot in robots.txt?

Add the following lines to your /robots.txt file: User-agent: GPTBot Disallow: / This instructs GPTBot not to crawl any path on your site. The Disallow: / directive covers the entire domain including subfolders. To only block specific sections, replace / with the path (e.g., Disallow: /blog/ ). Note: robots.txt is publicly readable - any bot or human can inspect it at yourdomain.com/robots.txt .

Q: How do I verify if GPTBot is crawling my site?

Search your web server access logs for the string GPTBot (case-insensitive grep: grep -i "GPTBot" /var/log/nginx/access.log ). You can also check Google Search Console → Coverage → Crawl Stats for Googlebot variants. For GPTBot specifically, filter by user-agent in your log analysis tool (GoAccess, AWStats, etc.).

Operated by OpenAI

Scout's quick take

GPTBot collects pages for OpenAI's AI training. Blocking it keeps your content out of future training runs and does not change your Google or Bing rankings.

User-agent: GPTBot
Disallow: /

Run a live crawler access test Build a full robots.txt

Quick Facts

User-Agent:: GPTBot
Category:: AI & LLM Bots
Operator:: OpenAI
Safety:: Safe
Blocking Impact:: Low - No SEO ranking impact
SEO Impact Score:: 2/10
Official docs:: developers.openai.com

Confirmed by the operator

OpenAI names GPTBot on its own documentation page, linked above. The token, purpose and robots.txt behaviour on this profile come from that page, re-checked on October 19, 2026.

What is GPTBot?

GPTBot is OpenAI's training crawler. OpenAI says it crawls "content that may be used in training our generative AI foundation models".

Disallowing GPTBot tells OpenAI not to use your content to train its models. It does not affect ChatGPT search, which is OAI-SearchBot. It identifies itself with the token GPTBot. OpenAI documents it at developers.openai.com.

What happens if you block GPTBot?

No effect on Google, Bing or ChatGPT search visibility.

Generally safe to allow; provides legitimate crawling value.

User-Agent: GPTBot

User-Agent: GPTBot is the robots.txt line that targets OpenAI's training crawler, and nothing else: ChatGPT-User and OAI-SearchBot need their own groups. See how the tokens differ in the GPTBot user agent comparison, and how to combine them in User-Agent: GPTBot best practices. For monitoring, see how do I monitor AI bot traffic to my website?

User-Agent: GPTBot
Disallow: /

How to block GPTBot with robots.txt

<code>User-agent: GPTBot</code> - Matching is case-insensitive. Robots.txt is fetched from the root of each subdomain separately.

Block completely (robots.txt)

User-agent: GPTBot
Disallow: /

Allow all (robots.txt)

User-agent: GPTBot
Allow: /

Block private only (robots.txt)

User-agent: GPTBot
Disallow: /private/
Disallow: /api/
Disallow: /admin/
Allow: /

Nginx server block

# Nginx: Hard-block GPTBot
if ($http_user_agent ~* "GPTBot") {
    return 403 "Bot blocked";
}

Apache .htaccess

# Apache: Hard-block GPTBot
SetEnvIfNoCase User-Agent "GPTBot" bad_bot
Order Allow,Deny
Allow from all
Deny from env=bad_bot

Meta robots tag

X-Robots-Tag header

X-Robots-Tag: noindex, nofollow

Is GPTBot safe to allow?

Yes. GPTBot is a documented bot: OpenAI publishes a page that names it and explains what it does.

Verify by reverse-DNS lookup: legitimate GPTBot requests resolve to openai's domain.

What does GPTBot do?

From OpenAI's own documentation.

GPTBot is OpenAI's training crawler.
Content may be used to train AI models
No effect on Google, Bing or ChatGPT search visibility.

GPTBot in context

GPTBot is a training crawler operated by OpenAI. In plain terms, it collects pages to train AI models. Our database files it under AI and LLM crawlers and ranks it Tier 1, the small set whose absence you would notice in AI answers or search results. 14 of the 104 AI and LLM crawlers in our database share this tier.

Its safety rating is safe and its blocking impact is low. So the decision about GPTBot rests on what you want from OpenAI, not on its behaviour. How we rate safety and impact.

How site owners treat GPTBot

In our own study of robots.txt files across the Tranco top 10,000 sites (fetched October 20, 2026, 5,583 valid files), 1,008 files (18.1%) name GPTBot in a User-agent line, and 859 (15.4%) block it from the homepage. 663 of those blocks come from a group written for this crawler by name, and 196 come from a broad User-agent: * rule that catches it by accident. Larger sites are stricter: 20.4% of the top 1,000 block it, against 15.5% of the middle band and 14.5% of the tail.

Does it follow robots.txt?

GPTBot's operator says it follows robots.txt, so a correctly written GPTBot group is enough to control it.

OpenAI crawlers and close alternatives

GPTBot is one of 7 OpenAI crawlers in our database. A User-agent: GPTBot group controls GPTBot only; the other OpenAI tokens below need their own lines.

GPTBot: this crawler (Tier 1)
ChatGPT Agent: ChatGPT Agent (Cloud browser), fetches a page when a person asks an assistant or app to open it (Tier 1)
ChatGPT Operator: ChatGPT Operator (Cloudflare name), fetches a page when a person asks an assistant or app to open it (Tier 1)
ChatGPT-User: ChatGPT Search, fetches a page when a person asks an assistant or app to open it (Tier 1)
ChatGPT-User/2.0: ChatGPT Search v2, fetches a page when a person asks an assistant or app to open it (Tier 1)
OAI-AdsBot: OpenAI Ads Validator, checks pages for an SEO, uptime or analytics service (Tier 2)
OAI-SearchBot: OpenAI Search, fetches a page when a person asks an assistant or app to open it (Tier 1)

To give GPTBot the same answer as its siblings, stack User-agent: GPTBot with their lines above one set of rules; to treat GPTBot differently, give it its own group.

Other AI and LLM crawlers that do the same job (collects pages to train AI models) include ClaudeBot from Anthropic, Google-Extended from Google, Meta-ExternalAgent from Meta, AI2Bot from Allen Institute for AI, aiHitBot from aiHit, anthropic-ai from Anthropic. Deciding about GPTBot is usually a decision about the whole group, so check how your file treats these too.

We first recorded GPTBot on March 17, 2026. OpenAI documents it on developers.openai.com, and we recheck that page before each release.

Which rule GPTBot actually follows

GPTBot reads exactly one group in robots.txt, the most specific one that names GPTBot, and never combines rules across groups. This short file shows the trap:

User-agent: *
Disallow: /private/

User-agent: GPTBot
Disallow: /drafts/

Find the group. GPTBot looks for a group naming GPTBot. One exists, so it ignores User-agent: * completely.
Apply only that group. It is refused /drafts/ and nothing else.
The surprise. /private/ is open to GPTBot, because that rule lives in the * group it no longer reads. To keep it out of both, repeat Disallow: /private/ inside its own group.

Test yourself: does a rule under User-agent: * apply to GPTBot if the file also has a User-agent: GPTBot group?

No. Once a group names it, GPTBot reads only that group. Put every rule you want it to follow inside its own group.

Test yourself: will blocking GPTBot remove your pages from AI answers?

No. GPTBot collects training data. Blocking it changes what future models learn, not which pages AI answers cite today.

Test yourself: is User-agent: gptbot the same as User-agent: GPTBot?

Yes. RFC 9309 makes user-agent matching case-insensitive. Paths are a different story: Disallow: /Blog/ does not block /blog/.

Should you allow GPTBot? Decide by situation

Recommended setting for GPTBot by type of site
If you are...	Recommended setting
You publish content and want AI answers to cite it	Your call. GPTBot is a training crawler, so blocking it does not remove you from AI answers; retrieval crawlers do that job.
You license content and want to stop AI training	Block it by name with `User-agent: GPTBot` and `Disallow: /`.
You run an online shop	Allow it unless your logs show it is costly.
Your server is under load from bots	Rate-limit before blocking. It is rated safe in our database.

Check GPTBot on your own site

Open /robots.txt on your domain and search for GPTBot. If it is not named, it follows User-agent: *.
List the Disallow lines in the group GPTBot follows and test your key URLs against them; the longest match wins, and Allow wins a tie.
Look beyond the file. A firewall or bot manager can refuse GPTBot even when robots.txt allows it, and that never shows in the file.
Run our AI search visibility check to see how GPTBot and every other crawler we track are treated in one pass, including firewall refusals.

Common mistakes with GPTBot

The errors we see most often with GPTBot in the files and firewalls we test:

Assuming that blocking GPTBot removes you from AI answers. It is a training crawler; AI answers are fed by retrieval and user-triggered crawlers with different tokens.
Blocking GPTBot with a broad User-agent: * rule that also catches search engines. Name GPTBot in its own group instead.
Expecting a GPTBot block to remove content already collected. robots.txt only affects future visits.

All three hide inside a file that looks correct, so check GPTBot from outside after every change.

Spotting GPTBot in your logs

robots.txt says what GPTBot may do; your access logs show what it actually did.

Count requests

On a server with standard Nginx or Apache logs, this counts matching requests per day (adjust the log path for your host):

grep -iE "GPTBot" /var/log/nginx/access.log \
  | awk '{print $4}' | cut -d: -f1 | sort | uniq -c

And this shows which paths it requested most, which is the quickest way to see whether your Disallow lines are being respected:

grep -iE "GPTBot" /var/log/nginx/access.log \
  | awk '{print $7}' | sort | uniq -c | sort -rn | head -20

Check the requests are genuine

Anyone can send the GPTBot user-agent, so confirm the source before acting on a match:

GPTBot: compare each address with the ranges at openai.com/gptbot.json. A request claiming to be GPTBot from outside them is not genuine.

Frequently Asked Questions

What is the official user-agent string for GPTBot?

The official user-agent string for GPTBot is: GPTBot. This is the exact string you must use in robots.txt, Nginx, Apache, or Cloudflare firewall rules to target this bot. User-agent matching in robots.txt is case-insensitive, but the string must be spelled correctly. You can verify that a request genuinely comes from GPTBot by performing a reverse-DNS lookup on the source IP - legitimate bots resolve back to their operator's domain.

Is GPTBot safe?

Yes. GPTBot is a documented bot: OpenAI publishes a page that names it and explains what it does.

Will blocking GPTBot hurt my SEO?

No effect on Google, Bing or ChatGPT search visibility.

How do I block GPTBot in robots.txt?

Add the following lines to your /robots.txt file:

User-agent: GPTBot
Disallow: /

This instructs GPTBot not to crawl any path on your site. The Disallow: / directive covers the entire domain including subfolders. To only block specific sections, replace / with the path (e.g., Disallow: /blog/). Note: robots.txt is publicly readable - any bot or human can inspect it at yourdomain.com/robots.txt.

Does GPTBot respect robots.txt?

Yes. OpenAI documents robots.txt control and publishes its IP ranges.

How do I verify if GPTBot is crawling my site?

Search your web server access logs for the string GPTBot (case-insensitive grep: grep -i "GPTBot" /var/log/nginx/access.log). You can also check Google Search Console → Coverage → Crawl Stats for Googlebot variants. For GPTBot specifically, filter by user-agent in your log analysis tool (GoAccess, AWStats, etc.).

What is the crawl frequency of GPTBot?

GPTBot crawls at a moderate rate. If you notice excessive traffic in your logs, you can add a Crawl-delay directive:

User-agent: GPTBot
Crawl-delay: 10

(10 second delay between requests).

Can I block GPTBot from specific pages only?

Yes. Instead of a global Disallow: / you can restrict GPTBot to specific paths:

User-agent: GPTBot
Disallow: /private/
Disallow: /staging/
Allow: /

This allows GPTBot everywhere except the listed paths. Path matching in robots.txt uses prefix matching - Disallow: /private/ blocks /private/page.html but NOT /public/private/.

Does blocking GPTBot prevent AI training on my content?

A robots.txt Disallow for GPTBot is the opt-out OpenAI documents. Robots.txt is voluntary, so for enforcement add a firewall or CDN rule. Disallowing GPTBot tells OpenAI not to use your content to train its models. It does not affect ChatGPT search, which is OAI-SearchBot.

Is there an alternative to robots.txt to opt out of GPTBot?

The opt-out OpenAI documents is robots.txt. A firewall, CDN or server rule that returns 403 for GPTBot enforces it. Per-bot meta tags and llms.txt are not opt-out mechanisms any major operator documents.