A MEASUREMENT, NOT AN OPINION

Googlebot gets a 200. ClaudeBot gets a 403. Same page, same second.

On 4 August 2026 we asked nytimes.com for its homepage as 10 different visitors. 3 AI crawlers were served. 5 were refused at the edge before they saw a byte. A plain unidentified client was served, and so was an ordinary browser. None of this appears in the site's robots.txt, so any checker that reads that file will tell you those 5 crawlers are welcome.

The Times almost certainly meant to do this. Most sites in the same position did not: the refusal arrived as a content delivery network default and nobody was told. This page shows the whole measurement, including the control request that decides what it is worth.

nytimes.com · fetched as each crawler
measured
Pick a visitor to see what the Times said to it
GPTBot403 Forbiddencollects pages for ChatGPT

The door was shut before it saw anything. GPTBot asked for the Times homepage and got a refusal, not a page. Nothing it might have learned from that page can reach ChatGPT, because it never received a word of it.

This refusal comes from the network in front of the website, not from the website itself. That matters because the usual place people look, the robots.txt file, does not mention any of this. Reading that file would tell you GPTBot is welcome.

Open to search, closed to answers. A 403 is the content delivery network refusing the request, and no edit to robots.txt undoes one, which is why we ask each crawler rather than reading the file. Google-Extended is the exception on this page: it is a robots.txt token with no crawler behind it, and the Times disallows it there.
Run this on your own site about 5 seconds, no signup
WHAT THIS MEASUREMENT IS WORTH

A spoofed fetch is an indication. The control request is what makes it a finding.

WHAT WE DO

We request the page from our own network, once per crawler, with that crawler's user agent, and record the status.

WHERE THAT FAILS

A real crawler arrives from its operator's published address range. A firewall keying on the address can refuse us and allow the real one, or allow us and refuse it.

WHAT FIXES IT

A control request as a plain unidentified client. Served control plus refused crawler means the rule keys on the name. Refused control means inconclusive, and we say so.

On this page the control was served, so the reading holds. Had it come back refused, the honest conclusion would only have been that the Times turns away anything unfamiliar, and we would have reported it as inconclusive instead of publishing it.

WHAT SETTLES IT

Your server logs, checked against the ranges each operator publishes.

A log records which crawlers actually arrived, what status they got and on which paths. All 7 operators we track publish machine-readable address ranges for exactly this purpose, so a request calling itself GPTBot can be checked rather than believed. Upload a log to the dashboard and OpenAEO reconciles it against the fetch above: where the two disagree, the log wins and we name the reading that was wrong.

That check catches something a fetch never can. A request claiming to be a crawler from outside its operator's range is not a visit, it is someone else scraping you under a name you may have chosen to allow, and it is reported separately rather than counted as traffic you wanted.

Questions people actually ask

Does the New York Times block AI crawlers?+
On 4 August 2026 we asked nytimes.com for its homepage as ten different visitors. Googlebot, Bingbot and Applebot were served a 200. GPTBot, OAI-SearchBot, ClaudeBot, Claude-SearchBot and PerplexityBot were refused with a 403. A plain unidentified client and an ordinary browser were both served. None of this appears in their robots.txt.
Why does robots.txt not show this?+
A 403 is returned by the network in front of the site, usually a content delivery network or a web application firewall. robots.txt is a file the site serves and a polite crawler reads, so it cannot describe a refusal that happens before the file is ever consulted. That is why a checker which only reads robots.txt will report these crawlers as allowed.
Can you trust a fetch that sends a crawler's user agent?+
Only so far, and the result says so. We send the request from our own network with the crawler's user agent, while the real crawler arrives from its operator's published address range. A firewall that checks the address can refuse us and allow the real crawler, or the reverse. That is why we also send a control request as a plain unidentified client: if the control is served and the crawler is refused, the rule keys on the name. If the control is refused too, we report the result as inconclusive rather than claiming more than we measured.
What actually settles whether a crawler reached a site?+
The site's own server logs. They record which crawlers arrived, what status they got and on which paths. OpenAEO reads an access log and checks every claimed crawler against the address ranges its operator publishes, so a request claiming to be GPTBot from outside OpenAI's range is reported as an impostor rather than counted as a visit. Where the log contradicts our fetch, the log wins and we say which reading was wrong.
Is it wrong for a site to block AI crawlers?+
No. It is lawful, and for a publisher it is often a deliberate commercial decision. The problem this page illustrates is a different one: many sites refusing AI crawlers never chose to, because a content delivery network default changed underneath them. The point is knowing which of the two you are.
How do I check my own site?+
Run the free audit on any public domain. It asks 8 AI crawlers for your homepage, sends the same control request, and reports what each one got. It needs no signup and takes about 5 seconds.

Find out what your own site tells them.

The same 8 crawlers, the same control request, on any public domain. Free, no signup.

Run free scan