Caution Reported AI & LLM Bots

Grok Bot (GrokAgent)

Operated by xAI

Quick Facts

User-Agent:
GrokAgent
Category:
AI & LLM Bots
Operator:
xAI
Safety:
Use Caution
Blocking Impact:
Low - No SEO ranking impact
SEO Impact Score:
2/10
Official docs:
None published by xAI
Named by:
Cloudflare Radar verified bots

Reported, not operator documented

xAI has not published a crawler page that names GrokAgent. It is listed here because a credible public source does: Cloudflare Radar verified bots. Cloudflare's verified-bot registry lists Grok Bot (xAI) with the user-agent pattern GrokAgent and a Web Bot Auth key directory. xAI's own Grok Bot documentation does not print the string, so it stays Reported.

What that means for you: the robots.txt rule on this page is the best available spelling, and a well-behaved crawler using this string will honour it, but there is no vendor statement of purpose, crawl rate or robots.txt compliance to rely on. Treat a matching request in your logs as a detection clue, not proof of who sent it, and combine the rule with a firewall rule if the traffic matters to you. If the operator publishes documentation, this profile moves to Official docs.

What is Grok Bot (GrokAgent)?

GrokAgent is the user-agent pattern that Cloudflare's verified-bot registry lists for Grok Bot, xAI's always-on AI agent. Each Grok Bot has its own cloud computer and browser, signs into the tools its user connects, and opens websites to finish tasks for that user.

Cloudflare files Grok Bot under AI Assistant and links a Web Bot Auth key directory for it, so its requests can be cryptographically verified (RFC 9421). xAI's own Grok Bot documentation does not print the GrokAgent string, which is why this profile carries the Reported badge. xAI says hosted Grok Bot computers use shared static egress IP ranges, available from the account team, and that a Bot has no identity of its own: it acts as the signed-in member. Older public registries also list GrokBot and xAI-SearchBot; those are separate, unverified crawler names.

What happens if you block Grok Bot?

✅ No SEO Impact - Grok Bot plays no part in Google or Bing rankings. Blocking it means a person who asked their Grok Bot to read, compare or book something on your site cannot get it done there.
Allow it on public pages and on the journeys you want agents to finish. Restrict it with firewall rules on login, checkout and account pages if you do not support agent sessions there.

Want to see whether Grok Bot (GrokAgent) actually visits you? Read how do I monitor AI bot traffic to my website?

How to control Grok Bot on your site

<code>User-agent: GrokAgent</code> is accepted by robots.txt syntax, but no operator documents that this agent reads robots.txt. Personal agents act for one signed-in person, so treat a robots.txt rule as a statement of intent and use your CDN or firewall (bot rules, Web Bot Auth verification, rate limits) to enforce it.

Block completely (robots.txt)
User-agent: GrokAgent Disallow: /
Allow all (robots.txt)
User-agent: GrokAgent Allow: /
Block private only (robots.txt)
User-agent: GrokAgent Disallow: /private/ Disallow: /api/ Disallow: /admin/ Allow: /
Nginx server block
# Nginx: Hard-block Grok Bot (xAI agent) if ($http_user_agent ~* "GrokAgent") { return 403 "Bot blocked"; }
Apache .htaccess
# Apache: Hard-block Grok Bot (xAI agent) SetEnvIfNoCase User-Agent "GrokAgent" bad_bot Order Allow,Deny Allow from all Deny from env=bad_bot
Meta robots tag
<meta name="robots" content="noindex, nofollow">
X-Robots-Tag header
X-Robots-Tag: noindex, nofollow

Is Grok Bot safe to allow?

Grok Bot is rated Caution: it is a capable agent that can sign in and take actions, and xAI has not documented robots.txt behaviour for it. Its requests are signed (Web Bot Auth), which makes it one of the easier agents to verify. Decide where you welcome agents, then allow or challenge it per path at the firewall rather than in robots.txt.
Verify the HTTP message signature against the key directory Cloudflare links for Grok Bot, or rely on Cloudflare Bot Management, which does this automatically. A GrokAgent user-agent without a valid signature should be treated as unverified.

What does Grok Bot do?

Understanding Grok Bot (xAI agent)'s purpose helps you decide whether to allow or block it.

  • Opens pages and fills forms for a single signed-in user
  • Runs scheduled routines that revisit the same sites
  • Signs into the user's own accounts on supported services
  • Hands login, two-factor and payment steps back to the person
  • robots.txt behaviour not documented by xAI

Frequently Asked Questions

Is GrokAgent the same as GrokBot?
No. GrokAgent is the user-agent Cloudflare lists for Grok Bot, xAI's AI agent product. GrokBot is an older crawler name reported by public registries that xAI has never documented.
Can robots.txt block Grok Bot?
Not reliably. xAI does not document robots.txt support for Grok Bot, and it acts for one person like a browser would. Use firewall or CDN rules, ideally ones that verify its Web Bot Auth signature.
How do I verify a GrokAgent request?
Check the Signature, Signature-Input and Signature-Agent headers against the published key directory (RFC 9421), or let Cloudflare Bot Management verify it. The user-agent string alone can be copied by anyone.
Will blocking Grok Bot hurt my SEO?
No. It has no role in search rankings. The cost is lost tasks: users who ask their Grok Bot to use your site will not be able to.
How do I find Grok Bot in my logs?
Search for the token: grep -i "GrokAgent" access.log, or paste your log into the free AI agent log checker.

Related Bots