Something occurred to me recently that feels embarrassingly obvious in hindsight.
A lot of WordPress sites now see requests from things like GPTBot, OAI-SearchBot, ClaudeBot or PerplexityBot. We recognize the name, maybe see it in a security log or access log, and mentally translate that into “OpenAI, Anthropic or Perplexity visited my site.”
But that is not what the log actually proves. What it proves is that somebody sent a request containing that User-Agent. Anyone can send User-Agent: GPTBot.
This isn't even a new problem. Fake Googlebot traffic has existed for years, which is why Google provides ways to verify whether something claiming to be Googlebot actually originates from Google. AI crawlers seem to have brought the same old problem back in a new form.
On WordPress this can become more than just a misleading log entry. Imagine you block generic scrapers but allow known AI crawlers, exclude certain bots from rate limiting, bypass page cache for specific crawlers, allow some crawlers access to content that ordinary scraping tools should not receive, or simply analyze AI crawler activity to see which providers are accessing which URLs.
If the identity behind those rules is based only on the User-Agent, a scraper may only need to call itself GPTBot or ClaudeBot to receive the same treatment.
The consequences can range from merely annoying to fairly significant. A fake bot can scrape content while masquerading as a crawler you intentionally allow. It can consume PHP, database and server resources that you thought were being used by a legitimate provider. It can also distort your WordPress, security or access-log analysis, so a report saying “GPTBot requested 500 pages” may not mean OpenAI requested those pages at all.
If your site grants known AI crawlers different access than unknown scrapers, a spoofed identity can potentially turn that trust decision against you.
Even people who simply block all AI bots have an interesting problem here. If you see 1,000 “GPTBot” requests and block them all, how many were actually OpenAI? Maybe all of them. Maybe none of them. Without verification, you don't know.
That seems like an important distinction: “This request claims to be GPTBot” is not the same statement as “This request has been verified as coming from GPTBot.”
Security plugins are very good at blocking traffic, rate limiting it and detecting suspicious behavior. But blocking is a policy decision. Verification is an identity question. I’m starting to think WordPress has mostly concentrated on the first question while barely discussing the second one for AI crawlers.
So I'm curious: when you see GPTBot, ClaudeBot, OAI-SearchBot or PerplexityBot in your WordPress or server logs, do you actually verify the identity, or have you basically been trusting the User-Agent?
Google's documentation on the underlying problem, for reference:
https://developers.google.com/search/docs/crawling-indexing/googlebot
Login
![[link]](https://i.redd.it/g1idqe9ct9mh1.jpeg){kind=link}