Guide · WordPress

Block fake AI bots on WordPress

Anyone can send a request that says “GPTBot” or “ClaudeBot”. Blocking that name blocks the real crawler too, and a scraper simply picks another name. The fix is to check the IP: a real GPTBot request comes from an address OpenAI publishes, and the same goes for most AI crawlers. In our log study at least 43% of AI-bot requests were impostors.

Option 1: the Verified AI Bot Analytics plugin (no server access needed)

1. Download the free Verified AI Bot Analytics plugin and upload it under Plugins → Add New → Upload Plugin. Activate.
2. Open Tools → AI Bot Analytics, tick Block fake AI bots, save.

The plugin downloads the operators' official IP lists once a day and returns 403 to any request that names a verifiable bot but comes from outside that bot's list. A genuine request can't fail the check, so you never block the real GPTBot or Googlebot. The same screen shows which AI bots visit you, real vs fake, and how many visitors ChatGPT, Perplexity and other assistants send you. It reads the real visitor IP behind Cloudflare.

Test it from your own computer (expect 403, then 200):

curl -s -o /dev/null -w "%{http_code}\n" -A "GPTBot/1.2" https://example.com/   # 403
curl -s -o /dev/null -w "%{http_code}\n" https://example.com/                     # 200

Option 2: server rules (fastest, covers cached pages)

• Shared hosting / Apache: paste our generated rules into the .htaccess in your WordPress folder, above the # BEGIN WordPress block. Steps: Apache guide.
• VPS with nginx: one include file with the official IP ranges, refreshed daily: nginx guide.
• Site behind Cloudflare: one free-plan WAF rule: Cloudflare guide.

These block before PHP runs, so they also save server load. Keep the plugin for the dashboard if you like; it just won't see the requests the server already refused.

Blocking the real AI bots is a different job

Real crawlers from OpenAI, Anthropic, Google and others follow robots.txt. WordPress serves a generated robots.txt when there is no file; to control AI crawlers, upload your own robots.txt to the site root (or edit it in your SEO plugin). Our robots.txt generator lets you allow AI search bots but refuse training crawlers, bot by bot. Fakes ignore robots.txt, which is why you need the IP check above.

Bots checked against official IP lists

• GPTBot (OpenAI)
• OAI-SearchBot (OpenAI)
• ChatGPT-User (OpenAI)
• OAI-AdsBot (OpenAI)
• ClaudeBot (Anthropic)
• Claude-SearchBot (Anthropic)
• Claude-User (Anthropic)
• PerplexityBot (Perplexity)
• Perplexity-User (Perplexity)
• Google-Extended (Google)
• Bingbot (Microsoft)
• Applebot (Apple)
• CCBot (Common Crawl)
• DuckAssistBot (DuckDuckGo)
• MistralAI-User (Mistral AI)
• Google-CloudVertexBot (Google)
• Googlebot (Google)

Bots whose operator publishes no IP list can't be verified this way; the plugin counts them as “can't verify” and never blocks them. Not sure what's hitting you? Upload an access log to the log checker.