The Hidden Cloudflare WAF Trap: Why robots.txt Allow Is Only Half the Battle
Many marketing teams inspect their https://yourdomain.com/robots.txt file, see User-agent: * Allow: /, and assume ChatGPT and Perplexity can read their site. However, when an automated crawler sends an HTTP GET request with User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.1, aggressive CDN firewalls (such as Cloudflare's Super Bot Fight Mode or AWS WAF) frequently intercept the request and return an HTTP 403 Forbidden or a JavaScript Managed Challenge page.
Because AI retrieval bots do not execute interactive browser CAPTCHAs, an HTTP 403 response means your website is completely dark to the AI engine. That is why RankBee's PACT scanner performs both a static robots.txt parser check and a live simulated bot-reachability probe (Check INF-01).
Copy-Paste 2026 Best-Practice robots.txt Template for Maximum AI Visibility
Below is the canonical 2026 robots.txt configuration used by high-scoring RankBee workspaces to welcome all major AI search engines while protecting private dashboard routes:
User-agent: *
Allow: /
Disallow: /api/
Disallow: /dashboard/
User-agent: GPTBot
Allow: /
User-agent: OAI-SearchBot
Allow: /
User-agent: ChatGPT-User
Allow: /
User-agent: PerplexityBot
Allow: /
User-agent: ClaudeBot
Allow: /
User-agent: Google-Extended
Allow: /
Sitemap: https://yourdomain.com/sitemap.xmlHow to Whitelist Verified AI Search Bots in Cloudflare
If your domain sits behind Cloudflare, navigate to Security → Bots in your Cloudflare dashboard. Ensure that "Block AI Bots" is set to Off (or create a custom WAF Skip Rule allowing verified bots where cf.client.bot is true for OpenAI, Perplexity, Anthropic, and Google). Immediately after updating your settings, run a free re-scan on rankb.ee to confirm Checks INF-01, INF-02, and INF-03 turn green.