Guides · 2026-08-28 · By VSNARY | Emmanuel Orta
How to rank in ChatGPT: the part that is actually in your control
There is no position three. There is retrieval, and there are four conditions your site has to satisfy before anything you publish is eligible to be used at all.
The question is asked more than almost anything else in this category, and the honest first answer is that it contains a false premise. There is no ranked list. An assistant does not hold position three for a query; it retrieves some documents, decides what to say, and may or may not name a source. Nobody outside the model provider can see the ordering, and the provider cannot reliably describe it either — a model asked how it ranks has no introspective access to its own retrieval. The same faculty that writes the answer writes the explanation, and neither is a trace.
What replaces the ranking question is narrower and far more useful: is your site eligible to be used? That decomposes into four conditions, all of which you control and all of which are checkable. Most sites fail at least one, and the failures are almost never in the place people go looking.
| Condition | The question | Fails on |
|---|---|---|
| Reachable | Does the fetch succeed for that crawler? | 3.4% of scans |
| Readable | Is what came back parseable? | 30.9% of scans |
| Quotable | Is there enough text to use? | 13.7% of scans |
| Resolvable | Are you distinguishable from anyone similar? | 3.9% of scans |
1. Reachable
Nothing else matters if the fetch fails. On one site measured here, GPTBot and ClaudeBot both received HTTP 502 while Googlebot and PerplexityBot were served normally — and robots.txt allowed all four. The refusal was at the edge, where almost nobody configures this deliberately. It usually arrives as a hosting default, a security plugin, or a managed bot-protection toggle that someone enabled years ago for an unrelated reason.
ANSWER_ENGINE_REFUSED fires on 3.4% of scans in the public dataset. The related pattern is a robots.txt that invites every engine while the edge turns them all away — a policy conflict that no validator reports, because both halves are individually valid.
Separately, 15.0% of scans find an AI opt-out already set. A meaningful share of those were never a decision. The eight largest opt-out groups on the web sit within 12% of each other — AppleBot at 108,452 sites, GPTBot at 107,182, Common Crawl at 102,665, ClaudeBot at 101,917. Eight independent operators do not get blocked in near-lockstep by eight independent decisions. That is one copy-pasted block, one plugin default, one hosting toggle. Check whether yours is yours.
2. Readable
The most common defect in the entire dataset is not a missing file. It is a file that exists, answers 200, and cannot be used.
A robots.txt that returns a bot-challenge page at 200 is read as allow-everything, because a parser that receives HTML finds no directives. A stale cached object on a machine file means the crawler and the browser are told different things. STALE_CACHE_SERVED fires on 30.9% of scans — 321 of 1,038, and it hides from testing because adding a cache-buster to the URL bypasses the cached copy and returns the correct file. Crawlers never append anything. They ask for the bare URL.
The ten-second version: fetch your robots.txt and read the content type, not the status. It must be text/plain.
3. Quotable
A model can only use text it was handed. The heaviest page in this corpus delivered 476,540 bytes carrying 2.3% visible text — the remainder markup, inline styles and script. It rendered fast, read well, and no validator objected. PAGE_IS_MOSTLY_CODE fires on 13.7% of scans.
Inline CSS is the usual cause and the worst kind of weight, because it cannot be cached between pages: a crawler pays for it again on every URL it fetches. This is also the one item on the list with a fix that is frequently a single setting in whatever built the site.
4. Resolvable
Being read is not the same as being identified. If an engine cannot tell you apart from a similarly named business two towns over, it will either decline to name anyone or name the wrong one, and both look identical from your side.
The web-wide shape of this is stark. Organization is detected on roughly 354,000 sites; OpeningHoursSpecification on roughly 23,000. Declaring that you exist is common. Declaring the specific facts an assistant is actually asked for — are you open, what does it cost, where exactly, how do I reach you — is an order of magnitude rarer. Are they open? is among the most common questions anyone asks about a business and among the least published machine-readable facts on the web.
State every important fact twice: in your structured data and in visible prose. A fact that exists only in your JSON-LD is a fact with a delivery condition attached, and readers exist that discard schema entirely and still form a view of who you are.
The trap: tuning to logs you have not verified
The obvious next move after all this is to open your server logs and see which engines came. Do that — but verify identity before you act on it. Across 2,510 checkable claims in this dataset, 37% came from an address outside the range the operator publishes.
| Claimed to be | Claims | Forged |
|---|---|---|
| Googlebot | 567 | 9.5% |
| ClaudeBot | 500 | 16.4% |
| Applebot | 493 | 37.9% |
| GPTBot | 300 | 47% |
| PerplexityBot | 189 | 51.9% |
| ChatGPT-User | 141 | 90.1% |
A user-agent is a claim, not an identity. OpenAI, Anthropic, Google, Microsoft, Perplexity and Apple all publish IP ranges, so the claim is checkable — and nearly half of the traffic calling itself GPTBot here is not GPTBot. Some of it is scanning for .env and credential files. Two consequences: do not conclude you are being crawled well because the log volume looks healthy, and never write edge rules that trust a user-agent string, because that is a rule anyone can satisfy by typing.
What is not in your control, and should be said plainly
The prompts buyers type. The model's training data and its update schedule. Which documents retrieval selects. Whether the answer names a source at all. Anyone selling certainty about those is selling a label, not a measurement.
What is in your control is the whole of the eligibility layer above, and it is the part almost nobody has checked. The order to work in is the order listed: reachable, then readable, then quotable, then resolvable. There is no value in improving step three while step one is refusing the fetch.
Then keep checking
Across 48 sites measured every day for fifteen days, 68.8% carried a defect on the last day, and 93.8% carried one at least once during the window. Twelve looked clean at the end and had not been clean throughout. A one-off audit produces the first number only. The gap between the two is what a single check, at any budget, structurally cannot see.
Every figure above came out of this scanner.
Point it at your own domain and see the same measurements, free.
Questions this post answers
How do you rank in ChatGPT?
There is no ranked position to hold. What you can control is eligibility: whether the fetch succeeds for that crawler, whether what comes back is parseable, whether enough of the payload is quotable text, and whether your entity is distinguishable from similar ones. All four are verifiable from outside your network; the ordering inside the model is not.
Does blocking or allowing AI crawlers affect whether ChatGPT cites me?
A refusal ends the question entirely, and many refusals were never decided by the site owner. 15.0% of scans in this dataset find an AI opt-out set, and the eight largest opt-out groups on the web sit within 12% of each other, which is the signature of an inherited default rather than eight separate decisions.
Can I use my server logs to see which AI crawlers visit?
Yes, but verify the identity against the operator's published IP ranges first. Of 2,510 checkable claims here, 37% came from outside the published range, including 47% of traffic calling itself GPTBot and 90.1% of traffic calling itself ChatGPT-User.