WordPress and ChatGPT Search: Five Places Your Site Blocks OAI-SearchBot

If your WordPress site never shows up in ChatGPT search, the first suspect is OAI-SearchBot, OpenAI's search crawler, being blocked somewhere between the visitor and WordPress. On a typical WordPress stack there are five places that can do it: the Reading settings, the robots.txt file, your SEO plugin, a security plugin and your CDN or host. This guide walks through each layer, in the order a request passes through them, with the exact menu paths and what OpenAI officially says about each bot.

Published: 2026-10-23 · 8 min read · Satelo

What ChatGPT needs from a WordPress site

OpenAI's help article on searching the web with ChatGPT lists two conditions for a website to be eligible: allow OAI-SearchBot to crawl it, and confirm that your host or content delivery network allows traffic from OpenAI's published search bot IP addresses. The same article says ChatGPT ranks results using multiple factors and that placement is not guaranteed.

So on WordPress the job is technical: make sure nothing in your stack says "no" to OpenAI's search crawler. OpenAI runs several bots, and they are configured separately. From the official overview of OpenAI crawlers:

The trap for WordPress owners: almost every "block AI" switch in plugins and CDNs was built around training bots, but some of them catch search crawlers too. Below is how to check each layer.

Layer 1: Settings → Reading → "Discourage search engines"

This checkbox is often left on after a site was built on staging or launched quietly. According to the WordPress documentation for the Reading screen, since WordPress 5.3 it adds <meta name='robots' content='noindex,nofollow' /> to every page. In WordPress 5.2 and earlier it made the virtual robots.txt return Disallow: / for all bots.

Does OAI-SearchBot obey a robots meta tag? OpenAI's crawler page documents robots.txt only and does not say how its search crawler treats noindex. Don't bet on it either way: if you want to be found, the box should be unchecked. Go to Settings → Reading → Search engine visibility, uncheck it and save. It also blocks Google and Bing, and ChatGPT search partners with third-party providers (the help article names Microsoft among them), so this one setting can hide you from several paths at once.

Layer 2: the robots.txt that is actually served

WordPress generates a virtual robots.txt when there is no physical file. The WordPress docs note that its built-in rules only work if WordPress sits in the site root and no robots.txt file exists. In practice that means:

• A physical file wins. If your host, an old plugin or a previous developer left a robots.txt in the web root, WordPress and your SEO plugin cannot change what bots see. Edits in the plugin screen silently do nothing.
• A catch-all rule counts. User-agent: * with Disallow: / blocks OAI-SearchBot too, unless a separate group names OAI-SearchBot and allows it. A bot follows the group that names it and only falls back to * when none does.
• Changes take a day. OpenAI says it can take about 24 hours after a robots.txt update for its systems to adjust.

Open https://yoursite.com/robots.txt in a private browser window and read it line by line, or paste your domain into our AI crawler checker: it parses the live file the way crawlers do and shows, for OAI-SearchBot, GPTBot, ChatGPT-User and nine other AI bots, whether a path is allowed and which line decides it.

A sensible default for a small WordPress site that wants ChatGPT visibility but no model training:

• User-agent: OAI-SearchBot / Allow: /
• User-agent: GPTBot / Disallow: /

If you don't mind training use, leave GPTBot out entirely. Our guide to blocking AI crawlers with robots.txt has copy-paste rule sets for other combinations.

Layer 3: AI switches in Yoast, Rank Math and AIOSEO

The three big SEO plugins all write to the virtual robots.txt, and they handle AI bots differently. What each vendor documents today:

Menu labels change between plugin versions, so treat the paths as a starting point. The test that never lies is the robots.txt file in the browser. If you are still choosing between the first two plugins, see our Rank Math vs Yoast comparison.

Standalone "block AI crawlers" plugins deserve the same check. Several of them toggle dozens of bots at once, and the defaults are whatever the author decided.

Layer 4: Wordfence and other security plugins

robots.txt is a polite request. A security plugin is enforcement: it answers with a 403 or a CAPTCHA, and the bot never sees your page. Three Wordfence features can catch crawlers:

• Rate limiting. Wordfence's rate limiting documentation separates rules for humans and crawlers and suggests "throttle" rather than "block" in most cases. An aggressive crawler rule can cut off any bot that fetches many pages in a burst.
• Country blocking (Premium). The country blocking docs warn that it makes no exception even for Googlebot if you block the country it crawls from. It makes none for OpenAI either. If you block whole countries, check where the IPs in OpenAI's searchbot.json are located before you rely on it.
• Manual and pattern blocks. Look under the blocking rules for user-agent patterns such as *bot* or *GPT* added during a scraping scare.

To see what is happening, open Wordfence → Tools → Live Traffic and filter for "OAI-SearchBot". Requests shown as blocked or throttled are your answer. If you use a different security plugin, look for its traffic or firewall log and search it the same way.

Layer 5: Cloudflare and your host's firewall

Many WordPress sites sit behind Cloudflare, and its AI controls have changed several times. Today Cloudflare's AI Crawl Control is available on all plans and lets you allow or block individual AI crawlers. Cloudflare's own Bot Preference Sync announcement describes separate Search, Agent and Training policies and says the settings can also write matching rules into your robots.txt. So a robots.txt you never wrote may come from Cloudflare, not WordPress.

What to check in the Cloudflare dashboard:

1. In AI Crawl Control, find OAI-SearchBot in the crawler list and confirm it is allowed. Do the same for ChatGPT-User if you want ChatGPT to open your pages when users share links.
2. Look for a "Block AI bots" setting under the security settings. If it is set to block on all pages, it applies at the firewall level, regardless of your robots.txt.
3. Review custom WAF rules and Bot Fight Mode for rules that challenge "unknown" bots.

Managed WordPress hosts often run their own firewall in front of your site. If logs show OpenAI's crawlers getting 403 responses and you can't find the cause in WordPress or Cloudflare, ask your host's support whether they block AI crawlers by default and send them the link to OpenAI's IP lists.

How to confirm OAI-SearchBot can actually get in

Go from cheapest to most reliable:

1. robots.txt check. Run your domain through the AI crawler checker. This covers layers 1 (on old WordPress versions), 2 and 3, and any rules Cloudflare writes into robots.txt.
2. Page source check. View source on your home page and search for noindex. That catches layer 1 on current WordPress and per-page noindex settings in your SEO plugin.
3. Server logs. In your host's raw access logs, search for OAI-SearchBot. Status 200 means the crawler got the page; 403, 429 or 503 means something in layers 4 or 5 stopped it. Confirm the IP is in OpenAI's published list, since anyone can fake the user-agent string.

Why not just run curl with OAI-SearchBot's user agent? It tests only user-agent rules. Firewalls that verify bots by IP will treat your request as a fake bot, and one that allowlists OpenAI's IPs will treat the real crawler differently than your test. Logs are the ground truth.

Once crawling works, measure the result: our guide to tracking AI traffic in GA4 shows how to separate visits from chatgpt.com in your reports.

Checklist: a WordPress site open to ChatGPT search

• Settings → Reading: "Discourage search engines" is unchecked.
• No stray physical robots.txt in the web root (unless you maintain it on purpose).
• Served robots.txt has no Disallow for OAI-SearchBot, directly or through User-agent: *.
• The SEO plugin's AI options block only what you meant (GPTBot for training, not OAI-SearchBot).
• Wordfence or another firewall shows OAI-SearchBot requests as allowed, not blocked or throttled.
• Cloudflare AI Crawl Control allows OAI-SearchBot; no blanket AI block on all pages.
• Logs show 200 responses to OAI-SearchBot from IPs in OpenAI's published list.

Technical access is only the entry ticket. Whether ChatGPT picks your page depends on content and reputation, which we cover in how to get your website indexed by ChatGPT and in the AI search hub.

What to do next

Start with the five-second check: enter your domain in the free AI crawler checker and see, rule by rule, whether OAI-SearchBot, GPTBot and ChatGPT-User are allowed on your WordPress site. Then work down the checklist above for the layers robots.txt can't show.

Being found also depends on other sites mentioning you. If you run a WordPress blog and want those mentions, the free Satelo plugin from the wordpress.org directory connects your site to a small network of similar sites that publish disclosed partner articles about each other (setup guide). Satelo is in public beta, and links in its articles use rel="sponsored".

FAQ

Does ChatGPT search work with WordPress sites?

Yes. ChatGPT does not care which CMS you use. A WordPress site is eligible as long as OAI-SearchBot is allowed in robots.txt and your host or CDN lets OpenAI's published search bot IP addresses through, as OpenAI's help center states. Placement is not guaranteed.

Does Yoast SEO block ChatGPT?

Not by default. Yoast SEO Premium can block GPTBot, Google-Extended and CCBot under Settings → Advanced → Crawl optimization. GPTBot is OpenAI's training crawler; OAI-SearchBot, the one ChatGPT search uses, is not in Yoast's documented list. Check your served robots.txt to be sure.

Does 'Discourage search engines from indexing this site' block ChatGPT?

It adds a noindex, nofollow robots meta tag to every page (since WordPress 5.3). OpenAI does not document how OAI-SearchBot treats noindex, and the setting also hides you from Bing and Google. If you want to be found anywhere, uncheck it.

How do I allow OAI-SearchBot in WordPress robots.txt?

Add a group with User-agent: OAI-SearchBot and Allow: / through your SEO plugin's robots.txt editor, or in the physical robots.txt file if one exists. OpenAI says it takes about 24 hours for changes to take effect.

Does Cloudflare block ChatGPT on my WordPress site?

It can. Cloudflare's AI Crawl Control lets you allow or block individual AI crawlers and can write matching rules into robots.txt. Check that OAI-SearchBot is allowed there and that no 'Block AI bots' setting applies to all pages.

How can I tell if OAI-SearchBot visited my WordPress site?

Search your server access logs or Wordfence Live Traffic for 'OAI-SearchBot'. A 200 status means it got the page. Verify the IP against openai.com/searchbot.json, because the user-agent string can be faked.

Read next

Can ChatGPT Read JavaScript Sites? How to Test What OpenAI's Crawlers SeeCan ChatGPT crawl JavaScript? What OpenAI documents, what independent crawler data shows, a curl test you can run today, and fixes for client-side sites.

ChatGPT Ads: How They Work, What They Don't Touch, and Whether a Small Site Should CareHow ChatGPT ads work as of October 2026: who sees them, how they're bought and ranked, whether they affect answers, and what small sites should do instead.

ChatGPT Atlas Is Retired: What It Means for Site Owners and What to Do InsteadChatGPT Atlas is retired. What that means for SEO: what still decides ChatGPT visibility, how ChatGPT's cloud browser reaches your site, and what to check now.

ChatGPT SEO Services: An Honest Buyer's Guide (What to Pay For and What to Do Yourself)A buyer's guide to ChatGPT SEO services: what agencies actually deliver, what no one can promise, red flags, questions to ask and what you can do yourself.