GPTBot is OpenAI's web crawler that collects public page content to train its AI models, and it identifies itself as GPTBot/1.4 in your raw server logs.
GPTBot is OpenAI's training crawler. It sends the user agent GPTBot/1.4, fetches raw HTML from public pages, and adds that text to the data pool used to train the models behind ChatGPT. You control GPTBot with a robots.txt rule for the user agent named GPTBot, and you confirm a request is genuine by checking it against OpenAI's published IP list at openai.com/gptbot.json.
Quick answer: OpenAI runs three separate agents with three separate jobs. GPTBot (user agent GPTBot/1.4) crawls the open web for model training. OAI-SearchBot (OAI-SearchBot/1.4) surfaces and links pages inside ChatGPT search. ChatGPT-User (ChatGPT-User/1.0) fetches a page in real time when a person or a Custom GPT asks about it. Each agent has its own name, its own purpose, and its own published IP range file. Blocking one does not block the others. GPTBot reads only the HTML your server returns and does not run JavaScript, so a browser analytics tag never records its visit. The one reliable record of a GPTBot hit is your server log.
What GPTBot is and what it does
GPTBot is the automated crawler OpenAI uses to gather publicly available web content for training its foundation models. When GPTBot requests a page, it downloads the HTML your server sends back and stores the text. Pages that GPTBot is allowed to read can end up in the training data behind future model versions. Pages you disallow are, by OpenAI's stated policy, excluded from that training set.
GPTBot is a training crawler, not the thing that answers a live ChatGPT question. That distinction trips up a lot of site owners. Seeing GPTBot in your logs means OpenAI is reading your content for training. It does not mean a user just asked ChatGPT about your page. Two different OpenAI agents handle those live lookups, and they are covered below. GPTBot is only one of the major AI crawlers reading sites today, and Anthropic's ClaudeBot and PerplexityBot follow the same split between training and live fetching.
The exact GPTBot user agent string
GPTBot announces itself with a fixed token. As of the current OpenAI documentation, the full user agent is:
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbotThe part that matters for filtering and for robots.txt is the product token GPTBot. The version number after the slash changes over time (1.4 at the time of writing), so match on the token GPTBot rather than on the full string.
GPTBot vs OAI-SearchBot vs ChatGPT-User
OpenAI splits its web activity across three named agents. Treat them as three separate decisions.
GPTBot/1.4 -> model training OAI-SearchBot/1.4 -> ChatGPT search results and links ChatGPT-User/1.0 -> live fetch when a user or Custom GPT asksOAI-SearchBot sends a user agent ending in OAI-SearchBot/1.4; +https://openai.com/searchbot. It powers the search feature inside ChatGPT. If you block it, your pages stop appearing as cited sources in ChatGPT's search answers. That is usually the opposite of what an SEO team wants, so block it only on purpose.
ChatGPT-User sends ChatGPT-User/1.0; +https://openai.com/bot. It fires when a person clicks a link or a Custom GPT visits a URL during a chat. OpenAI states it is not used for bulk automatic crawling, and robots.txt rules may not always apply to it because a human triggered the request.
The takeaway: GPTBot is the one tied to training. The other two are tied to answering. Deciding to keep your content out of training is a different call from deciding to appear in ChatGPT answers, and the three tokens let you set each separately.
How to verify GPTBot by IP address
User agents are trivial to spoof. A scraper can put the word GPTBot in its headers and pretend to be OpenAI. Real GPTBot traffic comes from a published set of IP ranges, and OpenAI posts one file per agent:
GPTBot -> https://openai.com/gptbot.json OAI-SearchBot -> https://openai.com/searchbot.json ChatGPT-User -> https://openai.com/chatgpt-user.jsonTo verify a hit, take the source IP from your log line and check whether it falls inside a range listed in the matching JSON file. A request claiming to be GPTBot from an IP outside gptbot.json is an impostor, and you can block it without touching real OpenAI traffic.
How to allow or block GPTBot in robots.txt
GPTBot obeys robots.txt. Put your rule in the file at the root of your domain, for example https://example.com/robots.txt.
To allow GPTBot everywhere (this is also the default if you say nothing):
User-agent: GPTBot Allow: /To block GPTBot from your whole site and keep your content out of training:
User-agent: GPTBot Disallow: /To keep training out of one section while allowing the rest:
User-agent: GPTBot Disallow: /members/ Disallow: /checkout/Remember that a GPTBot block is a training block only. It does not remove you from ChatGPT search (that is OAI-SearchBot) and it does not stop a live user fetch (that is ChatGPT-User). If you want to appear in AI answers but stay out of training, allow OAI-SearchBot and disallow GPTBot.
How to see GPTBot hitting your site
Here is the part most guides skip. GPTBot does not execute JavaScript. It reads the HTML your server returns and moves on. Google Analytics and every other browser-tag analytics tool depend on JavaScript running in a browser, so they never fire for GPTBot. Your GA dashboard will show zero GPTBot sessions no matter how often it crawls you. The visits are real, but the tag that would record them never runs. This is the same blind spot behind the question of whether AI crawlers execute JavaScript at all.
The only place a GPTBot request is written down is your web server access log. That is exactly what citAEOtion reads to track AI crawlers on WordPress. It classifies every hit by the real user agent, groups them into categories like AI Training, AI Search, and AI Assistant, and shows you which pages GPTBot pulled, when, how often, and with what HTTP status. You can literally see every GPTBot hit on your site instead of guessing whether OpenAI has read a page.
Plans start at $34.99 a month for a single site, with agency tiers and a Founders Club discount. Compare options on the citAEOtion pricing page, or book a live demo to watch it classify GPTBot traffic on a real WordPress install.
The full technical reference for every OpenAI agent lives in OpenAI's official bot documentation.
Frequently Asked Questions
Is GPTBot the same as ChatGPT?
No. GPTBot is the crawler that gathers training data. ChatGPT is the product people chat with. When a live ChatGPT session fetches a URL, that request comes from ChatGPT-User or OAI-SearchBot, not GPTBot.
Does blocking GPTBot remove me from ChatGPT answers?
No. Blocking GPTBot removes your content from model training. Appearing as a cited source in ChatGPT search is controlled by OAI-SearchBot. To stay visible in answers while staying out of training, allow OAI-SearchBot and disallow GPTBot.
How do I confirm a request really came from GPTBot?
Match the source IP against OpenAI's published list at openai.com/gptbot.json. A request with the GPTBot user agent from an IP outside that file is spoofed.
Why does Google Analytics show no GPTBot traffic?
GPTBot does not run JavaScript, and Google Analytics only records visitors whose browsers run its tracking script. GPTBot never triggers the script, so it is invisible to GA. Server-log tools such as citAEOtion see it because they read the raw request, not a browser event.
Does GPTBot obey Crawl-delay?
GPTBot follows standard robots.txt allow and disallow directives. For rate control, the most reliable lever is to disallow the paths you do not want crawled. IP-level rules on your server give you a second layer if traffic is heavy.