Googlebot gets a 200. ClaudeBot gets a 403. Same page, same second.
On 4 August 2026 we asked nytimes.com for its homepage as 10 different visitors. 3 AI crawlers were served. 5 were refused at the edge before they saw a byte. A plain unidentified client was served, and so was an ordinary browser. None of this appears in the site's robots.txt, so any checker that reads that file will tell you those 5 crawlers are welcome.
The Times almost certainly meant to do this. Most sites in the same position did not: the refusal arrived as a content delivery network default and nobody was told. This page shows the whole measurement, including the control request that decides what it is worth.
The door was shut before it saw anything. GPTBot asked for the Times homepage and got a refusal, not a page. Nothing it might have learned from that page can reach ChatGPT, because it never received a word of it.
This refusal comes from the network in front of the website, not from the website itself. That matters because the usual place people look, the robots.txt file, does not mention any of this. Reading that file would tell you GPTBot is welcome.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko);
compatible; GPTBot/1.1; +https://openai.com/gptbot
HTTP/1.1 403 Forbidden
This is the crawler behind ChatGPT's ability to look something up and cite it. Refused as well, which closes the second of the two routes into that assistant.
Blocking the collector and blocking the searcher are separate decisions. Here both were made the same way.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko);
compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot
HTTP/1.1 403 Forbidden
Same refusal, different company. The pattern across these five is the point: it is not one crawler having a bad day, it is a rule about a category of visitor.
If you run a site and want the opposite outcome, this is the layer you have to look at. No amount of tidying your pages changes a refusal that happens before the page is ever consulted.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: Mozilla/5.0 (compatible; ClaudeBot/1.0; [email protected])
HTTP/1.1 403 Forbidden
Refused. This is the crawler that would fetch a page in order to quote it in an answer, so a refusal here is the difference between being cited and being absent.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: Mozilla/5.0 (compatible; Claude-SearchBot/1.0; [email protected])
HTTP/1.1 403 Forbidden
Refused, completing the set. Five of the eight crawlers we ask for were turned away, and all five belong to assistants that answer questions rather than return a list of links.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36;
compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot
HTTP/1.1 403 Forbidden
Served the full page, immediately. This is what makes the contrast legible: the site is not closed, it is closed to a particular kind of visitor.
Search sends people to you. Answer engines often answer instead. Whichever side of that you want to be on, it should be a choice you made rather than one your network settings made for you.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
HTTP/1.1 200 OK
Served. Worth sitting with, because Bingbot's crawl feeds Copilot. The same company's assistant gets in through the search door while the assistants without a search business are refused at it.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)
HTTP/1.1 200 OK
Served. Apple's crawler has been fetching pages for Siri and Spotlight for years, long before the current wave, and it is generally treated as part of the furniture.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot)
HTTP/1.1 200 OK
This one is not a crawler. It is us, asking plainly, announcing nothing except our own name. It was served.
That single result is what turns the five refusals into a finding. If this request had also been refused, the honest conclusion would only be that the Times turns away anything unfamiliar, and we would have no business saying AI crawlers were singled out. Because it was served, we know the rule keys on the crawler's name. When the control comes back refused, this audit says inconclusive and stops there.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: OpenAEO-control/1.0 (+https://openaeo.dev/mcp)
HTTP/1.1 200 OK
Served, of course. Nothing here is broken and nothing here is an outage. A human reader gets the page every time.
That is precisely why this is invisible without measuring it. Everything looks fine from a browser, and the only visitors being refused are the ones nobody watches.
GET / HTTP/1.1
Host: www.nytimes.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/126.0 Safari/537.36
HTTP/1.1 200 OK
A spoofed fetch is an indication. The control request is what makes it a finding.
We request the page from our own network, once per crawler, with that crawler's user agent, and record the status.
A real crawler arrives from its operator's published address range. A firewall keying on the address can refuse us and allow the real one, or allow us and refuse it.
A control request as a plain unidentified client. Served control plus refused crawler means the rule keys on the name. Refused control means inconclusive, and we say so.
On this page the control was served, so the reading holds. Had it come back refused, the honest conclusion would only have been that the Times turns away anything unfamiliar, and we would have reported it as inconclusive instead of publishing it.
Your server logs, checked against the ranges each operator publishes.
A log records which crawlers actually arrived, what status they got and on which paths. All 7 operators we track publish machine-readable address ranges for exactly this purpose, so a request calling itself GPTBot can be checked rather than believed. Upload a log to the dashboard and OpenAEO reconciles it against the fetch above: where the two disagree, the log wins and we name the reading that was wrong.
That check catches something a fetch never can. A request claiming to be a crawler from outside its operator's range is not a visit, it is someone else scraping you under a name you may have chosen to allow, and it is reported separately rather than counted as traffic you wanted.
Questions people actually ask
Does the New York Times block AI crawlers?+
Why does robots.txt not show this?+
Can you trust a fetch that sends a crawler's user agent?+
What actually settles whether a crawler reached a site?+
Is it wrong for a site to block AI crawlers?+
How do I check my own site?+
Find out what your own site tells them.
The same 8 crawlers, the same control request, on any public domain. Free, no signup.