OpenAI · AI answers
ChatGPT-User
The fetch ChatGPT makes when a person asks it to open, browse, or cite a specific page. This is a live citation request, not GPTBot training.
- Operator
- OpenAI
- Traffic type
- AI answers
- Verification
- User-agent + IP range
- robots.txt
- User-triggered — often ignores robots.txt
Usually means: Live fetches when someone asks an assistant a question. If these bots cannot reach the page, you cannot be the citation in that answer.
User-agent
robots.txt and most WAF rules match the token, not the full Mozilla string. Operators often wrap ChatGPT-User in extra product or version text.
ChatGPT-User
Example full string: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot
What ChatGPT-User does
When a ChatGPT user needs a URL in the moment, OpenAI fetches that page as ChatGPT-User and may quote or cite what it can read. It is user-triggered, so robots.txt is often treated as a hint rather than a hard stop.
How to get discovered
Keep ChatGPT-User allowed, serve the answer in raw HTML, and make the first screen a quotable claim with a clear entity. If the page is a JavaScript shell, ChatGPT has nothing to cite even when the fetch succeeds.
Why ChatGPT-User might skip you
A Cloudflare “Block AI bots” rule, a WAF challenge, or a robots Disallow on ChatGPT-User returns an empty or blocked page. User-triggered fetches also skip URLs that 404, redirect into login walls, or only exist after client-side routing.
robots.txt rule
Allow this token on public pages you want retrieved or cited. A CDN “Block AI bots” toggle can still 403 it after robots.txt says Allow.
# Keep ChatGPT-User eligible to fetch this site
User-agent: ChatGPT-User
Allow: /Allowlist so ChatGPT-User can reach you
A user-agent is spoofable. OpenAI publishes current CIDR ranges as JSON — fetch that file for WAF/CDN allowlists instead of copying ranges from a blog. Ranges rotate; a screenshot of ten prefixes will go stale. If Cloudflare “Block AI bots” is on, this is the list that gets the real crawler through.
https://openai.com/chatgpt-user.json ↗
Sources
JavaScript: reads raw HTML only.
Other OpenAI bots
Training, search, and user-fetch tokens from the same operator are not interchangeable. Allow the discovery path even when you opt out of training.
ChatGPT-User FAQ
What is ChatGPT-User?
When a ChatGPT user needs a URL in the moment, OpenAI fetches that page as ChatGPT-User and may quote or cite what it can read. It is user-triggered, so robots.txt is often treated as a hint rather than a hard stop.
Should I allow ChatGPT-User in robots.txt?
Yes if you want OpenAI to be able to fetch and cite this site. Blocking ChatGPT-User is how pages stay invisible to that product even when Googlebot still crawls them.
How do I know a request is really ChatGPT-User?
A user-agent is a claim anyone can send. Match the ChatGPT-User token, then check the source IP against OpenAI’s published ranges. Use those ranges as a WAF allowlist so a “Block AI bots” rule does not 403 the real crawler.
Letting ChatGPT-User in is the start. Getting cited is the job.
Rankealo checks whether AI crawlers can reach you, then publishes pages built to be retrieved and quoted in ChatGPT, Claude, Perplexity, and Gemini.
