How to Block Bots on WordPress Without a CAPTCHA
Scoring guesses, traps prove. Deception-based bot blocking on WordPress: tripwires, honeytokens, canary credentials, monitor mode, and WP-CLI.
tutorialA source-backed guide to AI search visibility: crawler access, citable content, accurate schema, citation reporting, and referral measurement.
The short version: generative engine optimization (GEO) is good technical SEO plus original, attributable information and honest measurement. There is no special schema, magic text file, or reliable prompt pattern that guarantees a citation. Make the page indexable, publish information worth citing, keep it current, and measure citations and conversions where the platforms expose them.
Google now says this directly: its existing search quality and technical requirements also apply to AI Overviews and AI Mode. It specifically advises site owners not to overfocus on artificial content chunking, unnecessary AI text files, or special markup. See Google’s guide to generative search visibility.
Generative engine optimization is the work of making a source eligible, useful, and trustworthy enough to be referenced in an AI-generated answer. It does not replace SEO because most retrieval systems still depend on a search index, a crawler, or both.
The useful distinction is about measurement:
| Surface | Primary visibility signal | Useful outcome |
|---|---|---|
| Traditional search | Ranking, impressions, clicks | Qualified organic visit |
| AI search and answer engines | Citation or referenced URL | Qualified visit or accurate brand inclusion |
| User-directed agents | Successful retrieval or task completion | Completed user action |
Do not reduce GEO to a single “citation probability” score. Different products retrieve, summarize, cite, and report sources differently. A page can be crawled without being cited, cited without receiving a click, or visited without a usable referrer.
Crawler names encode different purposes. Treating every AI-related user agent as one bot leads to bad policy and bad analytics.
| Operator | Search/index crawler | User-directed fetcher | Training control |
|---|---|---|---|
| OpenAI | OAI-SearchBot | ChatGPT-User | GPTBot |
| Anthropic | Claude-SearchBot | Claude-User | ClaudeBot |
| Perplexity | PerplexityBot | Perplexity-User | No foundation-model training crawler identified in its current crawler documentation |
Googlebot | Product-dependent | Google-Extended controls some non-Search AI training and grounding uses; it does not control Google Search inclusion |
Sources: OpenAI publisher guidance, Anthropic crawler guidance, Perplexity crawler guidance, and Google’s AI feature controls.
If the goal is discovery in AI search, allow the search crawlers you want. Training is a separate policy decision. For example:
# Search discovery
User-agent: OAI-SearchBot
Allow: /
User-agent: Claude-SearchBot
Allow: /
User-agent: PerplexityBot
Allow: /
# Separate training preference
User-agent: GPTBot
Disallow: /
User-agent: ClaudeBot
Disallow: /Crawler groups do not merge under the Robots Exclusion Protocol. If you create a bot-specific group, repeat every rule that bot needs instead of assuming it inherits User-agent: *.
A permissive robots.txt is not enough when a CDN, WAF, rate limiter, or JavaScript challenge returns a 403 or 429. Test representative public pages with the actual search-crawler user agent and verify a usable 200 response. When a crawler publishes IP ranges, verify both the claimed user agent and network source before creating an allow rule.
WebDecoy’s crawler verification tools and Agent Identity product separate a claimed name from a proven identity. That distinction matters: a copied user-agent string is not an authentication mechanism.
The strongest citation candidates are not generic summaries. They contribute something a generated answer cannot obtain from every competing page.
Prioritize:
For a technical page, put the direct answer near the top, then show the evidence. A useful opening often contains:
That is good documentation design for people. It also gives retrieval systems a self-contained passage without manufacturing dozens of near-duplicate pages.
Weak:
Our advanced system is highly accurate and better than legacy bot protection.
Useful:
In WebDecoy’s 27 July–26 August 2026 dogfood snapshot, the site recorded 13,828 attributable AI crawler fetches and five referrals carrying a known AI-platform referrer. Because platforms can omit the referrer, five is a floor rather than a complete count.
The useful version states the source, window, measurement, and limitation. It can be cited without turning a local observation into a universal claim.
Use ordinary web metadata well:
lastmod values, not the build time stamped onto every URL.There is no special GEO schema. Article, TechArticle, SoftwareApplication, Dataset, and BreadcrumbList can clarify what a page contains, but they do not create authority. Never publish invented reviews, prices, performance numbers, or dates in JSON-LD. Structured data must agree with the page.
llms.txt is an experimental convention used by some developer-documentation tools. It can be a convenient, generated index for an agent, but major search visibility does not depend on it. Google explicitly says no AI text file is required for AI Overviews or AI Mode.
If you publish one, generate it from the same navigation or sitemap as the site so it cannot become a second, stale information architecture. Do not treat it as a ranking lever.
There is likewise no established /.well-known/ai-instructions.txt standard that makes answer engines follow brand wording or attribution preferences. Put important identity, licensing, pricing, and citation information in visible pages and standard metadata.
No single metric describes AI visibility.
Bing Webmaster Tools AI Performance reports when URLs are cited across Microsoft AI experiences. Google’s Generative AI performance report is rolling out in Search Console; when available, it separates visibility in generative features while retaining ordinary Search reporting.
Record, by canonical URL:
OpenAI says ChatGPT citation links include utm_source=chatgpt.com. Preserve that parameter in analytics and group known AI referrers without rewriting canonical URLs.
Referrals are still incomplete. Some products omit the HTTP Referer, open links through an intermediary, or send a user-directed fetch that is not a human visit. WebDecoy’s AI Traffic report therefore treats identified referrals as a floor and its crawl-to-referral ratio as an upper bound.
Crawler activity answers which automated clients fetched which pages. It does not prove that a model trained on a page, that an answer cited it, or that a crawl caused a later visit.
Use crawl activity as a diagnostic:
Automation is useful for finding stale facts, missing dates, broken citations, schema mismatches, and pages whose measured intent conflicts with their copy. It is risky when it generates large numbers of query permutations, FAQs, ratings, or unsourced claims.
A safe review pipeline should:
Do not infer “not cited” from zero referrals. Do not infer “cited” from a crawler hit. Do not publish generated FAQ or schema content that is absent from the visible page.
GEO is not a collection of secret tags. It is the discipline of making public information accessible, distinct, attributable, current, and measurable.
WebDecoy contributes the request-side evidence: which crawlers arrived, which identity claims held up, what they fetched, and which identifiable AI referrals returned. Search and answer platforms contribute citation and impression data. Analytics contributes the conversion outcome. Keep those observations separate, then join them by canonical URL and time window.
No. Google explicitly says AI text files are not required for its generative search features. An llms.txt file can be a convenient, experimental index for developer tools, but it is not a substitute for crawlable pages, internal links, sitemaps, or useful content.
Allow OAI-SearchBot for inclusion in ChatGPT search summaries and snippets. GPTBot is the separate control for potential model training, while ChatGPT-User fetches pages in response to a user's request.
Measure citations where platforms expose them, qualified referral traffic, conversions, crawl activity, and ordinary search visibility. Crawler requests alone do not prove that a page was cited, and referral logs undercount visits when a platform strips attribution headers.
Scoring guesses, traps prove. Deception-based bot blocking on WordPress: tripwires, honeytokens, canary credentials, monitor mode, and WP-CLI.
tutorialA hands-on Next.js guide to blocking AI crawlers: edge middleware to gate requests, honeypot routes to trap bots, and origin fingerprinting.
tutorialBuild a proof-of-work challenge system using Hashcash to stop bots without CAPTCHAs. Full tutorial with Node.js and browser code.
tutorialLike this post? Share it with your friends!
Get a personalized demo from our team.