GPTBot: robots token, verification and how to allow or disallow it
GPTBot is an AI crawler operated by OpenAI. Its robots.txt token is GPTBot, and the vendor documentation we fetched on 2026-09-06 is the source for every statement on this page.
| Robots token | GPTBot |
|---|---|
| Vendor | OpenAI |
| Purpose | training corpus |
| Documented verification | published IP ranges |
| Vendor documentation last verified | 2026-09-06 |
| Share of read domains disallowing it for / | 20.3% of 128 |
| Last verified |
Identity
| Robots token | GPTBot |
|---|---|
| Matched as | gptbot |
| Vendor | OpenAI |
| Purpose | training corpus |
| Documentation | https://platform.openai.com/docs/bots |
| Documented verification | published IP ranges: https://openai.com/gptbot.json |
Vendor page states the content may be used to train generative AI foundation models and publishes the IP range file. Documented UA sample contains 'GPTBot/1.4; +https://openai.com/gptbot'.
Allow or disallow it
User-agent: GPTBot Allow: /
User-agent: GPTBot Disallow: /
A robots.txt rule is a request that a well behaved crawler honours. It is not an access control, and this page does not tell anyone what to choose.
Questions
Does GPTBot obey robots.txt?
The vendor documentation at https://platform.openai.com/docs/bots states that GPTBot respects robots.txt. We fetched that page and it answered our checker on 2026-09-06. This records what the vendor documents, not what any individual request did.
How do I allow GPTBot in robots.txt?
Add this group to the robots.txt at the root of the host: User-agent: GPTBot Allow: /. The token is matched case insensitively as a substring of the user agent by RFC 9309, and the longest matching rule wins.
How do I disallow GPTBot in robots.txt?
Add this group to the robots.txt at the root of the host: User-agent: GPTBot Disallow: /. A robots.txt rule is a request that a well behaved crawler honours; it is not an access control.
How do I verify a request really came from GPTBot?
The vendor publishes the IP ranges this crawler fetches from at https://openai.com/gptbot.json. Check the address of the request against that file. A user agent string on its own proves nothing, because anyone can send one.
What we measure
Of the 128 seeded domains whose robots.txt we have read, 26 disallow GPTBot for / and 102 allow it, which is 20.3% disallowed, week 2026-W37. Counts only: no domain is named.
The weekly AI crawler access index
Sources
| Source | Type | HTTP | Verified | Note |
|---|---|---|---|---|
| https://platform.openai.com/docs/bots | vendor | 200 | 2026-09-06 | vendor redirects to developers.openai.com; 8 occurrences of GPTBot in the fetched body |
| https://openai.com/gptbot.json | vendor | 200 | 2026-09-06 | published IP ranges, also refreshed weekly into data/bot_ranges.json |
Free data
Check a domain against every token
AEO Watch is an independent, factual monitor. It is not affiliated with, endorsed by or speaking for any crawler vendor. Every statement is an observation with the date it was made and the raw evidence behind it: a robots.txt line, an HTTP status code, a header. There are no scores, no grades and no verdicts here, and nothing on this page is advice. A site opts out at any time and the opt out is honoured automatically and permanently.