GPTBot

What GPTBot does

A training crawler collects pages to train its operator's AI models. Its visits answer no one's question in the moment: what it reads goes into the data the models learn from.

How to recognize it

GPTBot names itself in its user agent with the token GPTBot. That's what Ethogram matches, as a whole word in any case.

A user agent is only a claim, though: anyone can send GPTBot. Scrapers borrow well-known names to get past rules meant for the real agent, so before you trust a visit, or block one, check where it came from.

How to tell it's really GPTBot

OpenAI publishes the IP ranges GPTBot uses, as JSON: openai.com/gptbot.json. A request from inside those ranges is the real GPTBot. One from outside them is an impostor.

Ethogram runs these checks on every request and gives each visit a verdict: verified, unverified or spoofed. Spoofed visits are counted apart and never added to GPTBot's numbers. How verdicts work.

Allow or block GPTBot in robots.txt

robots.txt groups its rules by user-agent token. To ask GPTBot to stay off your whole site, add this group:

To let it read everything, name it with an allow rule. A group that names GPTBot replaces the User-agent: * group for it, so it follows only these rules:

robots.txt is a request, not a lock: it's up to GPTBot to read it and follow it. Ethogram reads your robots.txt every day and shows whether GPTBot respects it, with the disallowed paths it asked for. To actually keep it out, use your firewall or bot protection, and check the visit's verdict first so you block impostors, not the real GPTBot.

See what GPTBot does on your site

Most analytics filter GPTBot out as a bot. Ethogram records it on your server, where every request lands, with no script to load, and shows:

• Every visit from GPTBot, with a verdict on whether it's really GPTBot.
• Each visit step by step: the pages it read, what it searched for, and where it was blocked, looped or hit an error.
• Whether it respects your robots.txt, with the disallowed paths it asked for.
• How much of your bandwidth it takes, next to its share of requests.
• Impostors that use its name, caught and counted apart from the real GPTBot.
• New versions of its user agent as they appear, and what changed in its behavior with each.
• A heads-up when its visits spike or stop, or when it starts getting blocked.