Cloudflare Blocking ChatGPT: How to Let ChatGPT's Bots Through on Any Plan

Why fix Cloudflare blocking ChatGPT at all? OpenAI's search help page says a site is only eligible for ChatGPT search if its host or CDN lets OpenAI's published search bot addresses in. And Cloudflare changed its defaults on 15 September 2026, so a zone you add today blocks ChatGPT-User on pages that show ads unless you say otherwise.

This guide is the setup, plan by plan. If you're not sure what is failing yet, start with our diagnosis guide to why Cloudflare blocks ChatGPT. For the full three-lane rulebook, with an IP list and a rule that blocks impostors, see our Cloudflare challenge trap guide.

What to Allow, and What You Can Keep Blocking

OpenAI lists four bots on its crawler page. Only two of them build ChatGPT's answers, so the allow-list that ends Cloudflare blocking ChatGPT can be short.

The categories come from Cloudflare's bot reference, and they matter because each Cloudflare preset acts on categories, not on names.

Step 1: The Settings Every Plan Shares

These four changes take ten minutes and fix most cases of Cloudflare blocking ChatGPT, whatever you pay.

Set the AI bot policies

Go to Security Settings, then Configure AI bot policies. Cloudflare's Block AI Bots page lists three presets, Search, Agent and Training, each with Block, Block on pages with ads, or Allow.

1. Search: set it to Allow. This covers OAI-SearchBot.
2. Agent: set it to Allow. Cloudflare's July 2026 post names ChatGPT-User as an example of an Agent. New zones start at Block on pages with ads.
3. Training: set it to Allow unless you accept the side effect. Cloudflare says any Training block now also stops crawlers that mix search and training, and it names Googlebot, Applebot and BingBot. New zones start at Block on pages with ads, so check this one too.

The same post explains why the presets come first. Cloudflare used to let every verified bot through by default. Now "Verified" only makes a bot allowable, and your Search and Agent choices decide whether it gets in.

Set each OpenAI crawler in AI Crawl Control

AI Crawl Control is on every plan. Open its Crawlers tab and set OAI-SearchBot and ChatGPT-User to Allow. If you want to refuse training, set GPTBot to Block here instead of using the Training preset. That blocks one crawler by name and leaves Googlebot and Bingbot alone.

Cloudflare enforces these blocks with a single custom rule named "AI Crawl Control," placed after your other custom rules. On the Free plan it spots crawlers by user agent only.

Give rate limits and old rules a bot exception

• Rate limiting rules: every plan can use the Verified Bot field, per Cloudflare's rate limiting docs. Add a condition that Verified Bot is false, so crawl bursts from OpenAI don't trip a limit meant for scrapers.
• Custom rules that block or challenge by country, ASN or path: add and not cf.client.bot. In the dashboard builder the field is called Known Bots, as in Cloudflare's own example.

Check Browser Integrity Check and Under Attack mode

Browser Integrity Check is on by default and challenges visitors with a missing or unusual user agent. Under Attack mode puts a JavaScript check in front of every page. If Security Events shows either one acting on OpenAI's bots, skip Browser Integrity Check for them with the rule below, and switch Under Attack mode off once an incident ends.

Step 2: Plan-by-Plan Setup to Stop Cloudflare Blocking ChatGPT

The bot product is where plans differ most, so it's where the allow-list differs too.

Rule counts come from Cloudflare's pages on custom rules and rate limiting. Enterprise zones without Bot Management get the Business setup.

Free plan

Once the presets are fixed, the usual cause of Cloudflare blocking ChatGPT on Free is Bot Fight Mode. It runs outside Cloudflare's rules engine, so a Skip rule has no effect on it. Set the presets and AI Crawl Control first. Then check Security Events. If you still see Bot Fight Mode challenging OAI-SearchBot or ChatGPT-User, turn it off under Security Settings, filtered to Bot traffic.

The only other escape is an IP Access rule, because Bot Fight Mode won't trigger when one matches first. It's rarely worth it. Those rules take IPv4 ranges only as a /16 or /24, or single addresses, and an Allow match also bypasses your custom rules, rate limits and managed rules without showing in Security Events. On 28 September 2026, OpenAI's search bot file held 39 ranges, which come to 2,050 entries in that format. Its ChatGPT-User file held 230 ranges, which come to 3,792. That's 5,842 rules for two bots, from files that change. The user file was regenerated on 25 September.

You can still add the Skip rule below on Free. It uses one of your five custom rules and exempts OpenAI's bots from your other rules, your rate limit and Browser Integrity Check.

Pro plan

On Pro, Cloudflare blocking ChatGPT usually means a Verified bots setting of Block or a scraper rule with no exception. Open Security Settings, filter to Bot traffic, and open Super Bot Fight Mode. Leave Verified bots on Allow. Definitely automated can stay on Block or Managed Challenge for scrapers. Cloudflare runs custom rules before Super Bot Fight Mode, so the Skip rule below, placed first, carves out OpenAI's bots. Pro allows 20 custom rules and 10 lists.

Business plan

Business adds a Likely automated group, which catches more sophisticated bots. Treat it like Definitely automated: challenge it, and rely on the Skip rule for OpenAI. Business also allows regex in rules, 100 custom rules, and rate limiting rules that can match on the user agent. Security Events keeps 3 days of history instead of 24 hours, which makes the final check easier.

Enterprise plan

With Bot Management, Cloudflare scores every request from 1 to 99 and replaces Super Bot Fight Mode. Its rule templates already exclude verified bots. For an exact allow-list, match the detection IDs in Cloudflare's bot reference: 126255384 and 33563986 for OAI-SearchBot, 132995013 and 33563857 for ChatGPT-User. Use this as the expression of a Skip rule at the top of your custom rules:

any(cf.bot_management.detection_ids[*] eq 126255384)
or any(cf.bot_management.detection_ids[*] eq 33563986)
or any(cf.bot_management.detection_ids[*] eq 132995013)
or any(cf.bot_management.detection_ids[*] eq 33563857)

If your team uses ChatGPT's cloud browser on your site, OpenAI's allowlisting page gives its Cloudflare detection ID as 129220581, shown as ChatGPT Operator in the picker.

The Skip Rule for Free, Pro and Business

This single rule ends most Cloudflare blocking ChatGPT on plans without Bot Management. It matches a request only when Cloudflare has verified it as a known bot and its user agent names one of OpenAI's two answer bots.

(cf.client.bot and (http.user_agent contains "OAI-SearchBot"
  or http.user_agent contains "ChatGPT-User"))

1. Go to Security rules, choose Create rule, then Custom rules, and paste the expression.
2. Set the action to Skip. Tick All remaining custom rules, All rate limiting rules and, on Pro and up, All Super Bot Fight Mode rules. Add Browser Integrity Check if it acted on these bots.
3. Leave Log matching requests on. Cloudflare's skip options say it's on by default, and it's how you'll confirm the rule works.
4. Drag the rule to the top of the list and deploy.

Three notes keep it safe. The contains operator is case-sensitive, so type the names exactly. A fake request that copies OpenAI's user agent fails cf.client.bot, so impostors don't get the skip. And Cloudflare doesn't document whether a Skip rule overrides the Search, Agent and Training presets, which is why Step 1 sets them directly. If a real OpenAI request doesn't match, Cloudflare may not treat it as verified. The challenge trap guide has a version that also matches OpenAI's published IP ranges.

The ChatGPT Allow-List Checklist

Our allow-list checklist puts the fix for Cloudflare blocking ChatGPT on one card. Tick each row for your plan, then run the test at the bottom.

To test, wait for real traffic. In Security Events, look for events from your Skip rule. Skip rules log each match by default, so each one is an OpenAI request that got through. On the AI Crawl Control Metrics tab, the Allowed requests view counts only 2xx responses. If Cloudflare blocking ChatGPT continues, our diagnosis guide maps each symptom to the setting behind it. A test from your own laptop won't tell you much, because your IP address isn't OpenAI's.

Where Rankbox Fits After You Open the Door

Rankbox doesn't manage Cloudflare, firewalls or robots.txt for you, and it doesn't track AI citations today. For the access side, use our free robots.txt tester and AI crawler log analyzer.

Once ChatGPT can read your site, the question is what it finds. Answer-Space Research maps the questions buyers ask ChatGPT, and the Citation-Ready Writer writes source-backed articles on them, which reach your site through Rankbox's API. See plans and pricing.