GPTBot on Vercel

By Matt Kerr·Published 12 November 2026

Vercel GPTBot guide and Vercel managed rules say: Vercel documents a custom rule specifically for GPTBot. Its AI Bots Managed Ruleset starts inactive at Allow, but a project can have a separate rule that targets GPTBot. Read both controls before deciding why a request is refused.

In Firewall, inspect a rule whose User Agent contains GPTBot. The GPTBot guide offers Deny, Challenge and Rate Limit. Choose the action you mean, review the pending edits and publish them before checking the public result.

Locate the GPTBot-specific rule

Vercel GPTBot guide says: The Vercel recipe begins in the project’s Firewall dashboard. It offers Add Rule or a template and says you can start from Block AI Bots, then modify it to match GPTBot. The match uses User Agent contains GPTBot. Check the text of an existing rule before using a broad template, because the guide is showing how to target this one name.

The same guide gives an example full header containing GPTBot/1.0. A request carrying that header is useful to locate a matching string rule. Anyone running curl can also send that text. Treat the check as a test of the condition you configured, and use the project traffic view to inspect the request that reached Vercel.

Choose the response you intend

Vercel GPTBot guide says: Deny is the guide’s persistent block choice. Vercel says requests matching that block will not reach static pages or Functions. Challenge asks the visitor to complete a browser-based check. The guide says a bot that cannot respond to that check will be blocked. Rate Limit caps the request frequency instead of expressing a whole-site ban. Choose based on the behavior you want for this named traffic.

Vercel managed rules says: A Log action is available for the broader AI categories in the managed ruleset guide. It records traffic without blocking it. Inspect that category separately from an explicit GPTBot rule. The two guides describe controls at different levels, and the managed ruleset page says project custom rules run before managed rulesets. A custom denial can therefore explain a refusal while the AI category shows Allow.

Compare one URL before and after the edit

Vercel GPTBot guide says: First read the domain’s robots.txt and any GPTBot group. Then request the same public page with a browser header and the GPTBot header below. Save response headers, including any redirects. These commands are examples for your computer. Replace the address with the domain attached to the Vercel project you inspected. Compare the status with the action in its published rule.

Vercel managed rules says: Use Review Changes and Publish when you apply an edit. Re-run the saved requests after publication. To reopen a request caught by a managed ruleset, Vercel documents a custom bypass. For a request caught by your own blocking custom rule, the bypass has to sit above that rule. Confirm the order in Firewall > Rules along with the action and user-agent text.

curl -sS -L https://example.com/robots.txt
curl -sS -L -D - -o /dev/null -A 'Mozilla/5.0' https://example.com/
curl -sS -L -D - -o /dev/null -A 'Mozilla/5.0 (compatible; GPTBot/1.0; +https://openai.com/gptbot)' https://example.com/