CHATGPT-USER
LOW RISK🤖 AI ASSISTANT BROWSERChatGPT's real-time web browsing mode that fetches pages during conversations
📡 CHATGPT-USER USER-AGENT STRING
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)
This is the User-Agent header sent by ChatGPT-User in HTTP requests. Use this to identify ChatGPT-User in your server access logs.
📋 ABOUT CHATGPT-USER
ChatGPT-User is the User-Agent identifier used by OpenAI's ChatGPT when it browses the web in real-time during user conversations. Unlike GPTBot, which crawls the web systematically for training data, ChatGPT-User fetches individual pages on demand when a ChatGPT Plus, Team, or Enterprise user asks the model to look something up on the internet.
This bot's traffic pattern is fundamentally different from traditional crawlers. Rather than systematic site-wide crawling, ChatGPT-User makes individual, one-off page requests driven by user queries. The traffic volume is proportional to ChatGPT's user base and their browsing habits. Each request represents a real user interaction where someone has asked ChatGPT for current information.
NORAD.io tracks ChatGPT-User activity to help site operators distinguish between AI training crawling (GPTBot) and real-time AI assistant browsing (ChatGPT-User). Many sites choose to allow ChatGPT-User while blocking GPTBot, since the browsing mode drives referral traffic and user engagement while the crawler collects training data.
🎯 HOW TO DETECT CHATGPT-USER
- ▸User-Agent contains 'ChatGPT-User' — distinct from 'GPTBot'
- ▸Requests are sporadic and user-driven, not systematic crawling patterns
- ▸Typically fetches single pages, not entire site structures
- ▸Shares IP ranges with GPTBot but has different User-Agent
- ▸May fetch pages at any time of day based on user activity
🌐 CHATGPT-USER KNOWN IP RANGES
20.15.240.64/2820.15.240.80/2820.15.240.96/2820.15.240.176/28Use these CIDR ranges to verify ChatGPT-User identity at the network level. Always combine with User-Agent verification for accurate detection.
🔄 CRAWL BEHAVIOR
On-demand fetching triggered by user conversations. Does not crawl systematically — only visits pages when a ChatGPT user explicitly requests web information. Single-page fetches with no follow-on crawling.
Fetches web pages in real-time to provide ChatGPT users with up-to-date information during conversations. Data is used for immediate response generation, not for model training.
🤖 ROBOTS.TXT CONFIGURATION
User-agent: ChatGPT-User Allow: / # To block: # User-agent: ChatGPT-User # Disallow: /
ChatGPT-User respects robots.txt directives. Add this to your robots.txt file at the root of your domain.
🗺️ WHERE IS CHATGPT-USER ACTIVE?
⚠️ RELATED THREATS
Attempts to override bot instructions via malicious content embedded in web pages
Data ExfiltrationBots attempting to extract sensitive data from websites including PII and credentials
Credential StuffingAutomated login attempts using leaked credentials from data breaches
Aggressive Content ScrapingBots aggressively scraping content beyond robots.txt limits and ToS
🔗 RELATED BOTS
📂 MORE 🤖 AI ASSISTANT BROWSERS
📚 RELATED GUIDES
PROTECT YOUR WEBSITE
Deploy SiteTrust to monitor and control AI bot access to your site with the Agent Passport Standard.
INSTALL SITETRUST →