GPTBot
OpenAI operates GPTBot to crawl content that may be used in training its generative AI foundation models. Site owners control it through the GPTBot robots.txt token, which OpenAI documents as honored; disallowing it signals that content should not be used in training. Verification uses the published IP ranges at openai.com/gptbot.json; OpenAI documents no reverse-DNS method.
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbotWhat GPTBot does
In access logs GPTBot identifies itself with a user-agent string such as Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot. OpenAI says the version number in that string may change, so match on the GPTBot token rather than a specific version. When the bot fetches robots.txt, OpenAI says it may add a robots.txt marker to the user-agent string, although the documentation gives no full example of that variant for GPTBot. OpenAI describes the visits as crawling content that may be used to train its generative AI foundation models and to make them more useful and safe.
Allowing GPTBot means the pages it fetches may be used in training OpenAI's generative AI foundation models. Disallowing it in robots.txt is, in OpenAI's words, an indication that the site's content should not be used in training those models. OpenAI treats the GPTBot and OAI-SearchBot robots.txt settings as independent, so blocking GPTBot does not by itself change how OAI-SearchBot handles the site. If both bots are allowed, OpenAI says it may use the results of a single crawl for both purposes to avoid crawling the same pages twice.
OpenAI publishes the IP prefixes GPTBot uses at openai.com/gptbot.json. The file has a creationTime field and a prefixes array of ipv4Prefix entries. Matching a request's source address against those prefixes is the only verification method OpenAI documents. OpenAI does not document whether GPTBot executes JavaScript.
Operator note. OpenAI says the version number in the user-agent string may change, and that "When fetching robots.txt files, we may add a robots.txt marker to the user-agent string". The documentation states: "OpenAI uses OAI-SearchBot and GPTBot robots.txt tags to enable webmasters to manage how their sites and content work with AI. Each setting is independent of the others". If both bots are allowed, OpenAI "may use the results from just one crawl for both use cases to avoid duplicative crawling." The documentation does not say whether GPTBot executes JavaScript.
Controlling GPTBot with robots.txt
Use the token GPTBot in robots.txt. OpenAI documents that GPTBot honors robots.txt directives.
User-agent: GPTBot
Disallow: /User-agent: GPTBot
Allow: /Verifying a request is really GPTBot
Anyone can put GPTBot in a User-Agent header. OpenAI publishes IP ranges for GPTBot at https://openai.com/gptbot.json. No reverse-DNS method is documented.
OpenAI publishes a machine-readable list. Our probe read it on 2026-09-06; the file's own creation time was 2025-10-30.
- Prefixes
- 21
- IPv4
- 21
- IPv6
- 0
First entries at fetch time: 132.196.86.0/24, 172.182.202.0/25, 172.182.204.0/24
SHA-256 of the fetched body: be778b84e1b5436be6ab9d6139ba2b3d6a98c1f581e038ec386e3a7d44cbfe50
Common questions
Should I block GPTBot?
That depends on whether you want your content used to train OpenAI's generative AI foundation models. OpenAI documents that disallowing GPTBot in robots.txt indicates the content should not be used for training, and that GPTBot honors the token. The setting is independent of OAI-SearchBot, so blocking GPTBot alone does not change OpenAI's search-related crawling.
How do I verify that a request claiming to be GPTBot is real?
Compare the source IP with the prefixes in https://openai.com/gptbot.json, the only verification method OpenAI documents. OpenAI does not document a reverse-DNS check for GPTBot. The file is JSON with a creationTime field and a prefixes array of ipv4Prefix entries.
Does GPTBot run JavaScript?
OpenAI's documentation does not say whether GPTBot executes JavaScript. The bot page covers the user-agent string and the robots.txt controls, and the gptbot.json file covers IP prefixes, but neither states how the crawler fetches or renders pages.
Sources
Every fact on this page was checked against OpenAI's own documentation, listed below, and re-checked by a second reviewer before publication. Reviewed September 2026.
Related crawlers
This registry documents how operators describe their own bots so site owners can identify and control them. It does not publish third-party IP lists or guess at undocumented behaviour. To see how your own site responds to automated visitors, the bot detection scanner reads a URL's live response and names the protection it finds.