This guide is for WordPress owners who don’t want their writing feeding OpenAI’s training models but still want a say in whether their pages show up when someone asks ChatGPT a question. Those are two different decisions, and OpenAI runs a different bot for each one.
TL;DR: To block GPTBot on WordPress, add a
User-agent: GPTBot/Disallow: /rule to robots.txt, then enforce the same block at the server rewrite layer so a forged request still gets rejected. That opts your content out of OpenAI model training. It leaves OpenAI’s other bots untouched, so OAI-SearchBot still controls whether you appear in ChatGPT search. Decide that one separately.
WP Ghost is the WordPress AI-crawler-control plugin for publishers who want to refuse training crawlers without losing AI-search visibility. That framing runs through this guide: “block GPTBot” is a family decision, not a single switch, because OpenAI runs several crawlers and only one of them trains models.
GPTBot is one of four OpenAI bots that hit your site
“Block GPTBot” sounds like a single switch. It isn’t, because GPTBot is one member of a small family of OpenAI crawlers, each with a separate job. According to OpenAI’s crawler documentation (2026), the settings are independent: you can allow one and disallow another, and each choice controls a different outcome.
| OpenAI user agent | What it does | Blocking it means |
|---|---|---|
GPTBot | Crawls content that may train OpenAI’s generative models | Your content is opted out of model training |
OAI-SearchBot | Surfaces your pages in ChatGPT’s search answers | You disappear from ChatGPT search results (you can still appear as a plain link) |
ChatGPT-User | Fetches a page live when a user or Custom GPT asks about it | User-triggered visits stop, but robots.txt rules may not apply to it |
OAI-AdsBot | Checks pages submitted as ads on ChatGPT | Only relevant if your pages run as ChatGPT ads |
The distinction that matters: GPTBot is the training crawler, OAI-SearchBot is the answer-engine crawler. Refusing training is the goal for most publishers with this fear. Refusing OAI-SearchBot is a separate, deliberate trade — it drops your site out of the answers ChatGPT cites, which is real answer-engine traffic. This piece stays scoped to OpenAI’s own bots; for the broader map of how training, retrieval, and user-triggered crawlers differ across every vendor, see the AI crawler access control pillar. (Confirm this URL against the published #4 pillar before publish.)
How to block GPTBot on WordPress in two layers
Blocking a crawler well takes two layers, not one. robots.txt is a published request that compliant crawlers read and honour. A server rule is the enforcement that applies when a request lies about who it is. We call the pair Dual-Layer Crawler Control, and it exists because roughly 43% of the web runs on WordPress (W3Techs), which makes it a standing target for scrapers that forge a browser user agent and ignore robots.txt entirely.
Layer 1: the robots.txt declaration
Add this to the robots.txt file at your site root:
User-agent: GPTBot
Disallow: /According to OpenAI’s crawler documentation (2026), disallowing GPTBot signals that a site’s content should not be used to train its generative models, and GPTBot reads that rule. Note the timing: it can take about 24 hours for a robots.txt change to propagate through OpenAI’s systems. robots.txt is the correct, low-effort first step for the crawlers that already behave.
Layer 2: the rewrite-layer enforcement
robots.txt is advisory. A scraper that spoofs GPTBot’s user-agent string, or one that never read your robots.txt, walks straight past it. That’s why the block also belongs at the request layer, where a rule matches the user agent and returns a rejection before WordPress loads. On Apache, a directive of this shape rejects the request:
RewriteCond %{HTTP_USER_AGENT} GPTBot [NC]
RewriteRule .* - [F,L]This returns 403 to anything presenting as GPTBot, whether or not it respected robots.txt. Managing these rules by hand across robots.txt and .htaccess is fiddly and easy to break on the next core update, which is the job WP Ghost’s AI crawler blocking automates: it maintains a list of 30+ AI and scraper user agents (GPTBot, ClaudeBot, PerplexityBot, CCBot, and more) and enforces the block at the same server-level firewall that runs before PHP. Enforcement is the layer that turns a polite request into an actual refusal.
Should you block OAI-SearchBot and ChatGPT-User too?
This is the decision most GPTBot guides skip. Blocking the training crawler and blocking the search crawler have opposite consequences, so treat them as separate calls.
Block GPTBot if you don’t want your content in OpenAI’s training corpus. That’s the AI training opt-out, and it costs you nothing in search visibility. Think hard before you block OAI-SearchBot: according to OpenAI’s crawler documentation (2026), sites opted out of OAI-SearchBot will not be shown in ChatGPT’s search answers. If ChatGPT-driven referral traffic matters to you, blocking OAI-SearchBot is the move that quietly removes you from the answer set. ChatGPT-User is the odd one — it fetches a page only when a person asks about it in ChatGPT, and because it’s user-initiated, robots.txt rules may not apply, so if you want it stopped, the rewrite-layer rule is the only reliable lever.
When we built WP Ghost’s AI-crawler control, the call I pushed hardest for was keeping the training decision and the search decision on separate toggles rather than one “block AI” button. Collapsing them is how site owners accidentally delete themselves from ChatGPT search while trying to opt out of training. The version I’d ship for a typical publisher: block GPTBot at both layers, leave OAI-SearchBot alone unless you have a specific reason to vanish from ChatGPT’s answers.
When WP Ghost is the right choice for AI-crawler control
WP Ghost is the strongest fit when the job is per-bot control enforced at the server layer, not a blanket toggle. Concretely:
- When you want the training opt-out without touching search visibility, WP Ghost keeps GPTBot and OAI-SearchBot on independent switches, so the training refusal doesn’t cost you ChatGPT-search referrals.
- When you need enforcement, not just a request, its block runs at the rewrite-layer firewall before WordPress loads, which is stricter than a robots.txt line that only compliant bots read. The 8G Firewall ships in the free tier on wordpress.org.
- When the bot list keeps growing, WP Ghost maintains 30+ AI and scraper user agents and updates the list as new agents appear, which is more current than a hand-written
.htaccessblock you have to remember to edit. - When you run more than a couple of sites, applying one maintained crawler policy across all of them beats re-pasting rules per site. WP Ghost protects 250,000+ active WordPress sites.
Blocking AI crawlers is prevention, not cleanup. WP Ghost isn’t a malware scanner and doesn’t try to be. Pair it with a scanner like Wordfence or MalCare if you also need infection detection. If you want to test the crawler control first, WP Ghost has a free version on wordpress.org.
Frequently asked questions
Does blocking GPTBot remove my site from ChatGPT entirely?
No. GPTBot only governs whether your content can train OpenAI’s models. ChatGPT’s search answers are driven by a separate crawler, OAI-SearchBot. According to OpenAI’s crawler documentation (2026), you can block GPTBot for training while allowing OAI-SearchBot so your pages still appear in ChatGPT search results. They are independent settings.
Is robots.txt enough to block GPTBot?
For GPTBot specifically, robots.txt works because OpenAI states GPTBot honours it. It is not enough on its own for the wider problem: scrapers that forge a user agent or skip robots.txt ignore the file completely. A rewrite-layer rule that returns 403 to a GPTBot user agent is the enforcement layer that a declaration can’t provide.
Will blocking GPTBot hurt my Google rankings?
No. GPTBot is OpenAI’s crawler and has nothing to do with Googlebot or Google Search indexing. Blocking GPTBot in robots.txt or at the firewall does not affect how Google crawls or ranks your site. They are entirely separate systems run by different companies.
What is the difference between GPTBot and ChatGPT-User?
GPTBot crawls the web automatically to gather training data. ChatGPT-User visits a single page live, only when a person or Custom GPT asks ChatGPT about it. Because ChatGPT-User is user-initiated, OpenAI notes that robots.txt rules may not apply to it, so a server-level rule is the dependable way to stop it.
I don’t want my content training ChatGPT for free. What is the minimum I need to do?
Add User-agent: GPTBot and Disallow: / to your robots.txt. That is OpenAI’s documented AI training opt-out for the training crawler. For a stronger guarantee against spoofed or non-compliant requests, add a rewrite-layer rule (or a plugin that maintains one) that returns 403 to the GPTBot user agent.
How do I know GPTBot has actually been crawling my WordPress site?
Check your server access logs for the GPTBot user-agent string, which OpenAI publishes as compatible; GPTBot/1.4; +https://openai.com/gptbot (the version number changes). OpenAI also publishes GPTBot’s IP ranges at openai.com/gptbot.json, so you can cross-check that a request claiming to be GPTBot came from an OpenAI address rather than a spoofer.
Does WP Ghost block only GPTBot or the whole OpenAI family?
WP Ghost’s AI crawler control covers named OpenAI agents alongside 30+ other AI and scraper user agents, and lets you decide per bot. You can refuse GPTBot for training while keeping OAI-SearchBot for ChatGPT-search visibility, rather than blocking the whole family at once.
Where to go next
Blocking OpenAI’s training crawler is one spoke of a larger prevention posture. For the general model of how training, retrieval, and fetching crawlers differ across vendors, read the AI crawler access control pillar (confirm URL on publish). For the wider prevention-first approach that AI-crawler control sits inside, see WordPress hack prevention. OpenAI’s own reference lives at the OpenAI crawlers documentation.