Skip to main content
Two different problems produce the same symptom - an empty Bot Traffic dashboard - and they have nothing to do with each other.

AI assistants are blocked

The panel at the top of Bot Traffic fetches your site from SnowSEO with every published crawler user agent - ChatGPT-User, OAI-SearchBot, GPTBot, Claude-User, Claude-SearchBot, ClaudeBot, Perplexity-User, PerplexityBot - and compares each response with what a browser gets from the same place at the same moment. A difference is the finding, and the response headers usually say which layer produced it. This runs from outside because it has to. A block at Cloudflare or at your host happens above your site entirely; from the inside there is nothing to see.

Cloudflare

The most common cause, and the one with the most moving parts.
  • Security → Bots carries Search, Agent and Training categories. From 15 September 2026 Cloudflare blocks Training and Agent by default on ad-bearing pages for new zones and existing free zones, unless you opt out.
  • Bot Fight Mode (free plan) issues CPU challenges that no crawler can solve. It runs outside the Ruleset Engine, so a WAF Skip rule cannot bypass it - the only fix is turning it off, or moving to Super Bot Fight Mode on Pro.
  • AI Crawl Control / pay-per-crawl answers 402 at the edge. The request never reaches your origin.
  • A WAF custom rule matching http.user_agent will do it too. On Pro and above, add a Skip rule.
Multi-purpose crawlers such as Googlebot and Applebot are classified as both Search and Training, so a restrictive Training policy can take out search crawling with it.

Managed hosting

robots.txt

Each token is independent. Blocking ClaudeBot does not block Claude-User, and blocking GPTBot does not block ChatGPT-User. That asymmetry is why a site can believe it is open to assistants while blocking the exact agent a person’s question would use, or the reverse. The reachability panel evaluates every token against your live robots.txt and names the one that matched.

Security plugins and server WAFs

  • Imunify360 (common on cPanel shared hosting) ships ModSecurity rules blocking 16 AI bots - rule IDs 88345386-88345402. Ask your host to disable them.
  • Wordfence has no deliberate AI blocking, but its rate limiting and bad-bot heuristics throttle crawlers. There is no “allow well-known AI crawlers” toggle.
  • Blackhole for Bad Bots bans anything that follows its honeypot link, and AI crawlers are not on its default whitelist. Add them and clear the existing ban.
  • OWASP CRS blocks AI training bots by default while allowing Google and Bing.
Anything blocked at the edge leaves no trace in a plugin’s own log, because the plugin never ran.

Checking by hand

Anything other than a matching 200 is a finding. Watch for 429 (host rate limit) and 307 (redirect to a challenge) as well as 403. Run this from outside your own network. A request from an address your firewall trusts proves nothing about one from Anthropic’s or OpenAI’s.

What is genuinely unmeasurable

Not every gap is a misconfiguration.
  • Google AI Overviews and AI Mode do not fetch your page. They answer from the Search index that Googlebot already built, so there is no request to count and no user agent to see.
  • Answers from training data involve no request at all.
  • Cached assistant fetches. Anthropic’s web_fetch caches by default, so a repeated fetch of the same URL may never reach you.
These are limits of the medium, not of the integration.