← Guides

How to check whether GPTBot visits your site

Updated 2026-08-03

Why check whether GPTBot visits you

GPTBot is OpenAI's crawler — it gathers data to train models and to answer inside ChatGPT. If it can't read your products, the assistant will quote the wrong price, show stale availability, or send the shopper to a competitor. Step one is knowing whether the bot shows up at all and what it sees.

In our AI Traffic Index for 13 Jul–1 Aug, three stores logged about 1,005,146 AI-bot hits, and a single vendor accounted for 606,017 — roughly 34,000 a day. This isn't background noise: the bots crawl constantly, and their visits are worth watching.

Step 1. Find GPTBot in your server logs

The fastest check is a grep on the User-Agent in your access log. For Nginx:

grep -i "GPTBot" /var/log/nginx/access.log

Count the visits in a file:

grep -ic "GPTBot" /var/log/nginx/access.log

OpenAI doesn't only use GPTBot. Check three User-Agents at once:

grep -iE "GPTBot|OAI-SearchBot|ChatGPT-User" /var/log/nginx/access.log | wc -l

• GPTBot — model training;
• OAI-SearchBot — the ChatGPT search index;
• ChatGPT-User — a real-time fetch triggered by a user's prompt.

See which pages the bot reads most:

grep -i "GPTBot" access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head

And always check the status codes:

grep -i "GPTBot" access.log | awk '{print $9}' | sort | uniq -c | sort -rn

If your product images return 403 or 406, the bot arrives but sees nothing — the number-one problem in our MD/RO store rating.

Why a User-Agent alone isn't enough

A User-Agent is just a string, and anyone can set it. A competitor's scraper, a scalper, or a spammer can knock on your door claiming to be GPTBot. Serve content to "GPTBot" without checking and you may be feeding an impostor; block it blindly and you might shut out the real crawler by mistake.

So every UA claim has to be confirmed by the request's source — its IP address.

Step 2. Verify the IP against OpenAI's published ranges

OpenAI publishes its official ranges as JSON: for GPTBot that's openai.com/gptbot.json, with separate files for SearchBot and ChatGPT-User. Each lists the CIDR subnets the genuine bot uses.

The routine is simple:

1. Take the IP from the log line.
2. Download OpenAI's current range file.
3. Check whether the IP falls inside one of the CIDRs.

A quick one-address check with grepcidr:

grepcidr -f openai-ranges.txt <(echo 203.0.113.10)

Classic reverse DNS — the way you'd verify Googlebot — is less reliable for OpenAI; the vendor recommends matching IP ranges instead. No match means it's a fake, even when the User-Agent looks perfect.

Handy rule: don't rely on JavaScript. Bots that execute JS behave like people; classic crawlers like GPTBot don't run JS, so your logs show only raw requests for HTML and files.

What the Botmetria dashboard shows

A manual grep is fine for a one-off, but ranges change and logs keep growing. Botmetria does it for you:

• Detection — recognizes GPTBot, OAI-SearchBot, ChatGPT-User and other vendors' bots (Perplexity, Anthropic, Google-Extended) by User-Agent;
• IP verification — matches every hit against the vendor's published ranges and flags impostors;
• Who came by — shows which bots visited, how often, and which pages they read.

You get in a minute the picture that would take an hour of log spelunking by hand. Start with a free Botmetria audit to see your AI-readiness score and whether bots are hitting errors.

Common mistakes

• Trusting the User-Agent without the IP. Half the "bots" in a raw log can be fakes.
• Blocking GPTBot along with search engines. Never touch Googlebot or Bingbot — it wrecks SEO; the Botmetria firewall has a built-in safeguard against this.
• Watching only GPTBot. Real purchases are also shaped by ChatGPT-User, the live fetch from a person's prompt.
• Ignoring status codes. A 403/406 on images means the bot showed up and saw nothing.

FAQ

Related guides

• GPTBot, PerplexityBot, ClaudeBot: who to allow in robots.txt