Why Is Cloudflare Blocking ChatGPT? How to Find and Fix It

The catch is that ChatGPT isn't one bot. OpenAI's crawler page lists OAI-SearchBot for ChatGPT search, ChatGPT-User for pages fetched when someone asks about them, and GPTBot for model training. A GPTBot block is often deliberate and doesn't touch search. The other two decide what ChatGPT can say about you. OpenAI's search help page says a site is only eligible if its host or CDN lets OpenAI's published search bot addresses through.

This post is the diagnosis for Cloudflare blocking ChatGPT: the symptom, the setting behind it, and the fix. For why these blocks happen and the full firewall rulebook, read our complete guide to the Cloudflare challenge trap. If you already know you want an allow-list, our plan-by-plan setup for letting ChatGPT's bots through covers Free, Pro, Business and Enterprise.

Which ChatGPT Bot Is Failing?

When you suspect Cloudflare blocking ChatGPT, start with the bot, because each one costs you something different. Cloudflare's bot reference files OpenAI's crawlers under different categories, and those categories decide which setting can catch them.

The last row matters if you advertise. OpenAI's ad guidelines say landing pages must not block OAI-AdsBot or OAI-SearchBot.

Two checks rule out false alarms. First, robots.txt is not Cloudflare's firewall, and many sites turn bots away there on purpose. In Rankbox's AI bot crawler census, 35.12% of news sites block ChatGPT-User in robots.txt and 28.78% block OAI-SearchBot. Test your file with our robots.txt tester. Second, Cloudflare's managed robots.txt disallows GPTBot but doesn't list OAI-SearchBot or ChatGPT-User, so a lone GPTBot refusal may be working as designed.

Tell a Cloudflare block from a server block

Cloudflare's 403 page says a 403 without Cloudflare branding comes from your origin, from things like .htaccess rules or mod_security. A branded 403 comes from Cloudflare itself.

• Error 1020, Access denied: a firewall rule blocked the request, per Cloudflare's 1020 page.
• Error 1015: a rate limiting rule, per the 1015 page.
• Error 1010: a banned "browser signature", which Cloudflare's 1010 page ties to Browser Integrity Check.
• A 402: pay per crawl, or an AI Crawl Control block response set to 402.
• A challenge page: every Cloudflare challenge carries the header cf-mitigated: challenge, per its detection docs.

How to Confirm Cloudflare Blocking ChatGPT in Your Dashboard

The fastest proof of Cloudflare blocking ChatGPT sits in screens every plan has. Work through these steps in one sitting.

1. Open Security Events. In the dashboard, go to the Analytics page and select the Events tab, as Cloudflare's docs describe. Set the widest time range your plan allows.
2. Narrow it to the bot. In Top events by source, find a user agent that names OAI-SearchBot or ChatGPT-User, hover it and choose Filter. You can also filter by the path ChatGPT couldn't read.
3. Read Events by service. It lists each security feature that acted on the filtered traffic.
4. Expand one event. In Sampled logs, open a matching row and note the Action, the Service, the rule name, the path and the Ray ID. Choose Edit columns to keep User agent and Path on screen.
5. If nothing shows, switch to Security Analytics. It shows all traffic, including requests Cloudflare let through. Filter to the bot. Requests served by your origin with errors point to your server.
6. Cross-check AI Crawl Control. On the Crawlers tab, read the Action column for each OpenAI bot. The Metrics tab charts status codes, and its 4xx line includes both 403 blocks and 402 payment requests.

What the Service field tells you

Cloudflare's AI Crawl Control guide says its blocks run as one custom rule called "AI Crawl Control," and that rules above it can block a bot you set to Allow without showing in its charts. Cloudflare doesn't document which Service label the Search, Agent and Training presets use, so if a label looks unfamiliar, read those presets directly.

How long the evidence lasts

On Free and Pro, Monday's block is gone from Security Events by Wednesday, so start with Security Analytics when the trail looks cold.

The ChatGPT Block Finder: Symptom, Cause, Fix

The ChatGPT block finder is our lookup table for Cloudflare blocking ChatGPT. Find the row that matches what you saw, confirm it, and apply only that fix. Changing several settings at once hides which one was the problem.

Three rows need a source. Cloudflare's July 2026 announcement names ChatGPT-User as an example of an Agent. Its Block AI Bots page says every Training block now also stops crawlers that mix search and training. And its rate limiting docs warn that limiting verified bots can hurt SEO. For the rule syntax behind these fixes, see the challenge trap guide.

Check That ChatGPT Can Read the Page Again

A fix for Cloudflare blocking ChatGPT only counts once a real OpenAI request gets through. A test from your laptop proves little, because your IP address isn't OpenAI's.

• AI Crawl Control: switch the Metrics tab to Allowed requests, which counts only 2xx responses, and filter to the bot you fixed.
• Security Analytics: filter to the bot's user agent and confirm its requests now show as served by Cloudflare or your origin, not mitigated.
• Your own logs: a day of access logs in our AI crawler log analyzer shows each bot's hits and status codes, and nothing leaves your browser. Our guide to tracking GPTBot and ClaudeBot covers where each host keeps those logs.

Then ask ChatGPT to open and summarize one specific URL. If it still can't, go back to step 1 with a fresh time range. Cloudflare saw in its August 2025 test that ChatGPT's fetcher stopped at a block page and no other user agent tried again, so each failed ask is a lost read.

Worked Example: Cloudflare Blocking ChatGPT on a Review Site

stackreview.co is a made-up software review site that runs display ads. It moved to Cloudflare Pro on 20 September 2026. A week later, ChatGPT tells the editor it can't open one of the site's reviews. The numbers are illustrative; the arithmetic is real.

Seven days of AI Crawl Control data show three problems:

The block finder splits this case of Cloudflare blocking ChatGPT into three causes:

1. ChatGPT-User: all 1,020 failures hit ad-carrying review pages, and the 460 requests to pages without ads worked. That's a success rate of 31.1% (460 ÷ 1,480). The zone is new, so this is the Agent default. The editor sets Agent to Allow.
2. OAI-SearchBot: 210 of 2,300 requests, 9.1%, tripped a rate limit written for scrapers. The team adds a Verified Bot exception to that rule.
3. GPTBot: blocked on purpose in AI Crawl Control. It stays that way.

The next week, ChatGPT-User made 1,390 requests and only 14 failed, all 404s from retired URLs. That's 1,376 of 1,390, or 99.0%. OAI-SearchBot made 2,410 requests with no 429s. The team redirects the dead URLs and moves on.

Where Rankbox Fits Once ChatGPT Can Read Your Pages

Rankbox doesn't change Cloudflare settings, firewalls or robots.txt, and it doesn't track AI citations today. For access checks, use the free tools above or run a page through the AI search readiness check.

Unblocking only puts your pages back in the pool ChatGPT reads from. What it finds there is the next job. Answer-Space Research maps the questions buyers ask ChatGPT, and the Citation-Ready Writer turns them into source-backed articles that reach your site through Rankbox's API. The Business plan is $49.50 a month: see pricing.