AI crawlers

GPTBot

Also known as OpenAI GPTBot

5 min read · updated 2026-09-09

Definition

GPTBot is OpenAI's crawler for collecting training data. Collects public pages that may improve future OpenAI models. OpenAI is gathering training data. This is the one to block if you object to training but want to stay in ChatGPT search.

For the reference card — GPTBot in the crawler directory.

What GPTBot is

GPTBot is the token most site owners have heard of, and the one most often blocked for the wrong reason. It collects material that may be used to train future models; it plays no part in ChatGPT answering a question today. If you have blocked GPTBot and are wondering why ChatGPT still quotes your site, this is why — that is ChatGPT-User, a different crawler with a different rule.

OpenAI runs four separate crawlers and gives each one its own token, which is more considerate than it first appears: it means you can refuse the training crawl and keep the one that puts you in ChatGPT's answers, using two lines in a robots file. Most operators on this site do not offer that choice.

On this site GPTBot is counted as training, which is the row it appears in on your dashboard. The category matters because it decides which number moves when this crawler visits, and the four are reported separately for exactly that reason.

What its traffic looks like

Broad and slow: many pages, few repeats, spread over days or weeks rather than concentrated. Training crawls tend to want everything once, so the long tail of a site sees traffic it never gets from search — old posts, deep archive pages, anything reachable by a link. Bandwidth is the usual reason people notice these at all.

How it is verified

Checked as ip ranges + reverse dns. The user agent has to carry the token, and then the address is compared against what OpenAI publishes — refetched every six hours, so a newly announced range is picked up without a deploy.

A request that matches neither is recorded as unverified rather than as a forgery: a published list can be incomplete, and an accusation needs evidence. Only a reverse DNS record resolving to somebody else produces a spoofed verdict, which is proof rather than the absence of it.

If you block it

Nothing today. GPTBot only collects material for future model training — blocking it does not remove you from ChatGPT search or stop ChatGPT citing you when someone asks. It is the cleanest single block available if your objection is to training.

Nothing you see today changes if you block this. Training crawls feed models that ship months later, so the decision is about whether your work becomes part of a commercial model, not about this quarter's traffic.

The honest counter-argument is that being in the training data is part of how a model comes to mention you at all. There is no measurement that settles this either way — anyone who tells you there is has not looked — so it is a decision about your terms rather than about your numbers.

How it differs from OpenAI's other crawlers

OpenAI sends 5 crawlers and gives each its own token, so they can be allowed and refused separately. The tokens differ by a few characters and what the fetch means does not:

ChatGPT-User — ai assistant. Fetches a page while ChatGPT is answering someone's question. ChatGPT-Agent — ai assistant. ChatGPT's agent mode browsing on a person's behalf. OAI-SearchBot — search indexing. Builds the index behind ChatGPT search. OAI-AdsBot — other bots. Checks pages submitted as ChatGPT ads.

Confusing two of these is the most common mistake with this operator, and it is expensive in one direction: a rule meant for the training crawler that lands on the search crawler removes you from results without stopping any training.

One real request

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot

Questions

Is GPTBot in my logs really OpenAI?
Not necessarily, and that is why it is worth checking. Any script can send GPTBot as its user agent. OpenAI publishes the addresses its crawler uses, so the claim can be tested against them — a request from outside those ranges is recorded as unverified rather than accepted.
How do I tell GPTBot apart from OpenAI's other crawlers?
By the token, and only by the token. OpenAI also sends ChatGPT-User, ChatGPT-Agent, OAI-SearchBot, and the strings differ by a few characters while the jobs differ completely — one may be answering somebody's question while another collects training material. Match on the exact token rather than on the operator's name appearing anywhere in the header, or the four end up counted as one.
Does GPTBot run JavaScript?
No. It requests the HTML and leaves. That is why a browser-based analytics tag never records these visits: the tag is JavaScript, and nothing runs it. Seeing this crawler at all requires reading it server-side.
Why is GPTBot counted as Training and not something else?
Because that is the job this particular crawler does. OpenAI runs more than one — ChatGPT-User, ChatGPT-Agent, OAI-SearchBot — and they are counted separately because the decisions about them are separate. Filing them together under one operator name would let ordinary indexing look like AI interest, which is the single most misleading thing an AI traffic report can do.
Why does GPTBot not show up in Google Analytics?
Google Analytics runs in the browser. This crawler never opens a browser — it requests the HTML, reads it, and leaves, so the tracking script is never executed and no event is ever sent. Every browser-based analytics tool has the same blind spot, which is why crawler traffic has to be read from the server side to be seen at all.
What happens if a GPTBot visit cannot be verified?
It is recorded as unverified, not as a forgery. A published address list can be incomplete or behind — an operator can start using a range before it appears in the file — so a miss is not evidence of anyone pretending. A visit is only marked as spoofed when the address's own reverse DNS record resolves to somebody else, which is proof rather than absence of proof.

See whether GPTBot is reaching your pages.

AI crawlers take your HTML and leave without running a line of JavaScript, so a browser tag records nothing. TrueStat reads them server-side, checks each address against what the operator publishes, and shows you which pages were fetched — including the ones that returned a 404.