AI WAF block tester

Compare a browser-like request with an OAI-SearchBot header probe for the same public URL. Inspect HTTP status codes and whether each response contains usable HTML. Both requests come from the scanner network.

A differing response can identify a header-sensitive rule. This probe does not originate from OpenAI IP ranges, so it cannot prove that a genuine crawler is allowed or blocked. Confirm the cause in source-verified server logs.

maintains Let The Bots In, a technical AI-readiness scanner and reference site.

Read the technical guide · Browse finding fixes

How do I run this check?

  1. Enter the public URL, including the path you want to inspect.
  2. Review the focused observations and the measurement coverage.
  3. Open a finding's fix guide, confirm the evidence and apply the relevant change.
  4. Rescan the same URL. Use Overview to inspect the full six-category breakdown.

Frequently asked questions

Does a 403 prove ChatGPT is blocked?

A 403 from this probe proves that this request was refused. It does not prove a refusal from OpenAI infrastructure. Check real request source IPs and the matching security event.

Can a JavaScript challenge block a crawler despite robots.txt?

Yes. A robots.txt allow rule does not bypass server challenges. Inspect the body as well as the status because challenge pages can sometimes return HTTP 200.

Should I allowlist every request named OAI-SearchBot?

No. User-Agent headers are easy to copy. Verify the sender using operator IP references or the CDN verified-bot signal, then scope any exception to the public route and offending rule.