← Guides

Bots get 403 on product images: how to find and fix it

Updated 2026-08-03

The #1 problem in the MD/RO rating

We ran 63 stores from Moldova and Romania through the Botmetria audit. The median score came out at 38 out of 100. The most common reason for lost points isn't price data or a missing sitemap — it's product images: the server returns 403 Forbidden or 406 Not Acceptable to AI bots instead of the actual file.

The Hygiene category is worth 15% of the total score, and response codes on static files are a big chunk of it. If a bot can't download product.jpg, those points are gone on the spot.

Why a 403 on an image is a lost sale

An AI agent builds a product card from two things: structured data (JSON-LD Product with price and availability) and the image referenced in the image field. The model reads price and stock from the markup, but if the image URL returns 403, your product shows up with no visual in ChatGPT or Perplexity — and often drops out of the shopping carousel entirely.

To a shopper it looks like this: a competitor with a working image made the shortlist, and you didn't. Your markup is perfect, yet the product might as well not exist.

Where the 403s and 406s come from

Almost always it isn't the store engine blocking the image but a protection layer sitting in front of it. Four usual suspects:

• Hotlink protection. The rule kills requests with no Referer header or a foreign domain. AI bots fetch images without a referer — straight into the trap.
• WAF / Cloudflare. Managed rules and Bot Fight Mode cut any automated traffic by User-Agent, honest GPTBot and PerplexityBot included.
• mod_security. Aggressive rule sets (OWASP CRS) return 406/403 on the bot's "suspicious" headers.
• Manual block lists. Someone once banned Bytespider and took out half the AI bots along with it.

How to find it in five minutes

Request one image as a bot — plug in a real product image URL:

curl -A "GPTBot" -I https://your-store.md/wp-content/uploads/2024/07/product.jpg

Check the first line. HTTP/2 200 — you're fine. 403 or 406 — the image is being blocked. Repeat with -A "PerplexityBot" and -A "ClaudeBot"; blocks are often selective.

Then the server logs. Filter /wp-content/uploads for 403/406 by bot User-Agent. A pile of refusals for GPTBot confirms the diagnosis.

Or run the Botmetria audit: it requests static files as AI bots and shows, under Hygiene, which images return an error.

How to fix it

The goal: let verified AI bots reach your static files without opening the door to real abuse.

1. Allow an empty Referer in hotlink protection. Bots send no referer, so you can't block it. In Apache the line RewriteCond %{HTTP_REFERER} !^$ must let the empty value through; in nginx valid_referers must include none.
2. Add AI bots to your WAF/Cloudflare exceptions for the image path. A whitelist on /wp-content/uploads for GPTBot, OAI-SearchBot, PerplexityBot, ClaudeBot and Google-Extended is enough.
3. Check mod_security. Loosen or disable rules that fire on static files — an image doesn't need the same scrutiny as a checkout form.
4. Verify bots by IP, not by name. User-Agents are trivial to fake. Botmetria matches AI bots against vendors' published IP ranges, so the real GPTBot passes and a spoof doesn't.

A safe nginx hotlink rule:

location ~* \.(jpe?g|png|webp|gif)$ {
    valid_referers none blocked your-store.md *.your-store.md;
    if ($invalid_referer) { return 403; }
}

none is the key word: it lets referer-less requests — every AI bot — through.

Common mistakes

• Blocking all automated traffic at once. Bot Fight Mode takes out AI bots and classic crawlers alike. Never block Googlebot or Bingbot — that kills your regular SEO. The Botmetria firewall has this safeguard built in.
• Filtering by User-Agent only. You either let fakes in or cut off real bots. The right way is matching by vendor IP range.
• Fixing one image. The problem is systemic: if a hotlink rule blocks, it blocks the whole catalog. Fix the rule, not the single file.

FAQ