CrawlCheck
robots.txt for AI crawlers · free, no signup

robots.txt for GPTBot, ClaudeBot, PerplexityBot and Google-Extended: what yours actually permits

In one sentence

A robots.txt check for AI crawlers resolves the file per agent the way each crawler does — group by group, longest match first — and then compares that policy with what the edge actually served each identity, because an allow rule means nothing when the firewall answers 403.

Type a domain. The scan reads robots.txt once and resolves it per agent, the way each crawler would - group by group, longest match first - then compares that with what the edge actually served each identity. A rule that says allow means nothing if the firewall says 403.

No signup. Nothing installed. Nothing changed on your site. The same scan as the homepage - about 30 read-only requests - and the same report, opened at the sections that answer this question.

How often robots.txt says something other than intended
An AI opt-out is already setAI_OPTOUT_SET3.7%Named AI groups drop the * rulesROBOTS_RULES_SHADOWED12%No sitemap declaredROBOTS_NO_SITEMAP8%robots.txt does not answer 200ROBOTS_NOT_2006.1%Disallow: / for everyoneROBOTS_DISALLOW_ALL1.2%A catch-all page, not a robots fileROBOTS_IS_CATCHALL0.6%Share of 4,320 scans in the public dataset that carried the finding. Live; the same figures as /data.

Is your site one of them? Check it free → All 63 rates →

Measured

What the scan measures for this

Per-agent policy

For every named AI crawler: allowed or refused at the root, whether it is named at all, and whether an allow-list for one agent silently shadowed the disallows meant for another.

See this section on a real report: Crawler permissions →

The edge versus the file

What GPTBot, ClaudeBot and PerplexityBot actually received when they asked - a 200, a challenge page or a 403 - regardless of what robots.txt says.

See this section on a real report: What each crawler gets →

The file itself

Status, content type, cache age and the Sitemap line, fetched as fifteen identities so a file that is served differently to a crawler is caught.

See this section on a real report: Machine files →

What the file points at

The Sitemap directive is followed: does it resolve, does it parse, and do the URLs it declares answer 200.

See this section on a real report: Sitemap →

For agents

What an agent is told about the same site

An agent does not read the report. It asks one endpoint before it reads, cites, connects or transacts, and gets a signed answer built from the same measurement.

1 · See it

The agent view

The answer an agent receives about any domain, rendered for a person: each action’s decision and the reason.

Agent view

2 · Call it

One endpoint

GET /api/v1/resolve?domain= returns the signed answer; preflight returns a decision and a receipt for one action.

QuickstartResolve spec

3 · Check it

Without trusting us

Every answer is Ed25519-signed and logged; it verifies offline with the published key.

Signing keysProof

Workflow

The workflow

  1. Scan the domainOne robots.txt fetch, resolved for every agent, plus the homepage as each identity so the edge is measured too.
  2. Read the AI agents sectionEach crawler on one row: named, allowed, shadowed, refused at the edge. The Fix list ranks the ones that hold the grade down.
  3. Download the corrected fileThe free fix below returns your robots.txt with the shadowed rules and the missing Sitemap line repaired, every change listed at the top.
  4. Publish, purge, re-scanA robots.txt is cached hard by most stacks. The second scan confirms the crawlers now read the file you meant to publish.
Free

Free tools for this

Each one is a single request to the domain you name, answered as text or a download. Put the domain on the end of the URL, or use the form on the tools page.

Reading

Read next

Start from what you are checking

You cannot pay to improve a score. A licence adds the lists behind the counts and the record over time - never a better grade.

Questions about this page

QMy robots.txt allows GPTBot. Why is it marked refused?
Because robots.txt is a request and the edge is a decision. If the firewall, bot-fight mode or a challenge page answers the crawler with anything but 200, the crawler never reads the page, whatever the file says. The Trust section shows the bytes each identity received.
QWhat is a shadowed rule?
A group written for one user-agent that silently voids the rules meant for another. The most common form is an allow-list added for named AI agents that made every Disallow above it stop applying to them. The per-agent resolver names which agent each rule actually reaches.
QDo AI crawlers obey robots.txt?
The major operators publish that their crawlers do, and verified requests in our own logs are consistent with that. Unverified traffic wearing a crawler's name is a different matter; the free verifier checks a log line against published address ranges.
QShould I block AI crawlers?
That is a business decision the scan does not make for you. It records what each crawler is told and what it receives, so the decision you made is the one actually in force.