Can a bank block GPTBot and still appear in ChatGPT search?

The short version

Your bank can block GPTBot and still appear in ChatGPT search by allowing OAI-SearchBot. OpenAI’s crawler documentation says these settings are independent. Search access does not require permission for training crawling, and permission to crawl does not guarantee inclusion.

Separate the three identities

The practical distinction in GPTBot vs OAI-SearchBot is purpose. Do not treat every OpenAI request as the same activity.

GPTBot. OpenAI’s stated purpose: Crawls content that may be used in foundation-model training. What it means for your decision: Disallow it if your institution does not want that training crawling.

OAI-SearchBot. OpenAI’s stated purpose: Surfaces websites in ChatGPT search. What it means for your decision: Allow it if you want your public pages accessible for search consideration.

ChatGPT-User. OpenAI’s stated purpose: Handles user-initiated actions, rather than automatic crawling. What it means for your decision: Do not use its access as a test of search eligibility.

These distinctions come from OpenAI’s overview of its crawlers. OpenAI also says robots.txt rules may not apply to user-initiated actions through ChatGPT-User.

That last point matters when someone reports, “ChatGPT opened our page.” Ask which identity requested it. A successful user-initiated visit is not evidence that OAI-SearchBot has access.

Understand the navigational-link exception

OpenAI says sites that opt out of OAI-SearchBot are not shown in search answers, but may still appear as navigational links. That exception means seeing a link to your institution does not, by itself, prove that search crawling is allowed.

Record what you actually observed: a direct link to your institution, a mention within an answer, or a citation supporting an answer. Keep the prompt and response alongside that observation. Do not turn every appearance into evidence that your crawl settings work.

Check robots.txt and firewall access separately

Start with your institution’s intended policy: permit search crawling of public content, disallow training crawling, or another deliberate choice. Then ask the person responsible for the website to compare that policy with the live configuration.

For the search-allowed, training-disallowed choice, the relevant robots.txt groups can look like this:

```text User-agent: GPTBot Disallow: /

User-agent: OAI-SearchBot Allow: / ```

Treat this as an illustration, not a replacement for your full file. Before using it, inspect existing named groups, wildcard rules, and path restrictions. Check each relevant website hostname rather than assuming one file represents every public property.

Next, check network access. OpenAI recommends both allowing OAI-SearchBot in robots.txt and permitting its published IP ranges. Ask your web or security contact to compare firewall settings with the current ranges linked in that documentation.

Use a short checklist:

Save the live robots.txt file before making changes.

Find rules naming GPTBot and OAI-SearchBot, including repeated groups.

Compare the intended policy with the actual directives.

Check firewall rules and request logs against OpenAI’s published IP ranges.

Test access to representative public pages, such as product and branch pages.

Record the changed setting, affected hostname, owner, and date.

Keep authenticated account areas, application records, and other private content outside this exercise. Do not change login or access protections to accommodate a search crawler. The task is to check access to content you intend to publish.

Recheck access before measuring appearances

After a change, fetch the live robots.txt file again and inspect the relevant firewall settings. When requests appear in your logs, check whether the intended public pages were accessible. Keep technical access checks separate from observations of ChatGPT answers.

Then repeat a small, saved set of search prompts about your institution and its public products. Record the prompt, date, answer, links, and citations. If your institution is absent, do not assume the crawler is blocked. If it appears, do not assume that the change caused the appearance.

For a small team, keep this crawl-access record alongside your marketing measurement work. Assign the configuration checks to whoever owns the relevant website settings, with your digital team keeping the before-and-after evidence.

Questions people ask