How to get my business on ChatGPT? There is no form — there are three doors, and I had set none of mine.

You typed that question, or something like it, and much of what came back opened the same way: there is no form. Then it sent you to claim a Google Business Profile, and stopped. The first sentence is right. What follows it skips the step that decides everything else.

OpenAI’s instructions for site owners contain no form either. They describe a program that reads websites, the way Google’s does — a crawler in the trade, a bot on every screen below. OpenAI’s search bot is named OAI-SearchBot, and OpenAI’s help page on ChatGPT search has a section headed Make your website available in search results. The section says “Placement is not guaranteed”; after it comes what it takes:

OpenAI’s help page, on what makes a site eligible

To make a website eligible for inclusion, allow OAI-Searchbot to crawl the site and confirm that the website host or content delivery network allows traffic from OpenAI’s published searchbot IP addresses.

Read it as a list. Allow the bot — that is your robots.txt, a few public lines of text at a fixed address on your site. The website host — the company whose computers hold your site. The content delivery network — CDN for short: a service that stands in front of your site and answers on its behalf; Cloudflare is a common one, and the one mine use. Three doors, three keepers, and not a word on how to open any of them.

A customer saying you weren’t in the list has two explanations: a door is shut, or ChatGPT read you and did not pick you. This article is about the first. If all three doors turn out to be open, it is done with you: the doors were never your problem.

Find out who keeps your doors

The first door you can open yourself, in your address bar, and the second detect there; the rest you will have to ask about — which is what the message below is for. Changing any of them needs whoever holds its login — and if a freelancer built your site years ago, you may not know whether you have Cloudflare, who hosts you, or whether the site sits on a builder like Wix, Squarespace or GoDaddy’s.

Door 3 starts from the bill. It usually leads to your host — sometimes directly, sometimes through whoever built the site and resells it — and whoever built it knows the login. On a site builder, hosting is normally the builder’s own, and whether anything stands in front of it is a question only the builder can answer. I have no site on one and tested none, so the message below is written to work whoever reads it.

Door 2 has a tell. Type your domain followed by /cdn-cgi/trace into the address bar. A page of plain text lines — fl=, h=, ip=, colo= and so on — means Cloudflare is in front of your site, and somebody holds the login. A not-found means it is not. If in doubt, ask.

At a dead end, send this to whoever built or hosts the site, and read on so you can judge the answer:

To read that last answer: 404, the code for a missing page, means the request got through; 403 means a door refused it, and the refusal page says which — Cloudflare’s reads Your request was blocked.; a different refusal page came from behind Cloudflare — the host, or the site itself.

Open your three doors

The whole check is three lines; the states, and the traps, follow.

1. In your robots.txt: no search bot’s name, and no User-agent: *, above a Disallow: / with nothing after the slash.
2. In Cloudflare, if you have it: under Security Settings, Configure AI bot policies, the Search row reads Allow (do not block) — and Training is not on Block, which would refuse Google’s bot too. If the older Block AI bots is still there, it reads Do not block.
3. At your host, if it refuses bots by name: the four search names explicitly allowed for your site — not left on an in-between or conditional setting.

Door 1 — the file. robots.txt is a public notice — which bot, which addresses to skip — with nothing standing behind it, and it is usually harmless. A whole file can be this short, and a site built on WordPress often shows something like it — every bot asked to skip one folder:

User-agent: *
Disallow: /wp-admin/

The slash decides. Something after it names one folder; a slash alone, Disallow: /, means the whole site — the bot named above it is asked to stay out of everything. And User-agent: * means every bot not named elsewhere in the file, so that pair can shut search out without naming a single search bot. A page-not-found at that address means there is no file, so nothing asks anyone out: the door is open. The four search names are OAI-SearchBot, Claude-SearchBot, PerplexityBot and Applebot. Two traps while you look. GPTBot sounds like ChatGPT’s bot and is not: OpenAI’s page describing its bots files it under training — collecting pages to teach the model — and says of the two names, “Each setting is independent of the others”; the one that decides whether you appear in ChatGPT search is OAI-SearchBot. (Anthropic’s training and search bots are ClaudeBot and Claude-SearchBot, on its page on its bots.) And Applebot-Extended above a Disallow: / is not Apple’s search bot asked out: Apple’s page on Applebot says “Applebot-Extended does not crawl webpages”. It is a word in the file, telling the one bot that does both jobs search yes, training no. The name to look for is Applebot exactly, with nothing after it.

If a search name, or the star, does sit above Disallow: /: lines you wrote, delete. Lines you did not — a block Cloudflare writes in, or one a host inserts — are not fixed in the file; the writer is Door 2’s switch or the host’s, and that is what to change. Cloudflare’s block, until 15 September, asked nine names on my sites to stay out, none a search name; if none is in what you find, Door 1 is open.

Door 2 — Cloudflare, if you have it. The panel that decides sits under Security Settings, Configure AI bot policies: three rows, Search, Agent, Training, each with three choices of the same shape; every row on my screen reads Allow (do not block), which Cloudflare now badges Recommended on all three, Training included. Leave Search there, and do not reach for Block on the Training row to compensate: Cloudflare’s own blog says “multi-purpose crawlers such as Googlebot, Applebot, and BingBot will be blocked by customers who have selected to block Training”. Block training there and you lose Google.

The older setting, Block AI bots, was labelled [Deprecating on September 15] on the 10th; on the 16th it was gone from the dialog on all four of my sites. If yours still shows it, it wants Do not block — Block on all pages is what shut one of my sites, below. What a site left on the block inherited, I cannot say: mine were on Do not block before the date. Look.

Below the rows now sits one more switch, Enable Bot Preference Sync — “Bot Preference Sync prepends your robots.txt with your configured Cloudflare settings.” On for all four of my sites, it replaces the old Instruct AI bots to not scrape content under AI Crawl Control: it writes into Door 1 what the rows say, and with all three on Allow it wrote nothing. Leave it.

Door 3 — your host. Some hosting companies refuse bots at the server, matched on the name a bot announces when it asks for a page — the user-agent — independently of robots.txt and of any service in front of the site; a bot set to block gets a 403, the code for understood, and no. Such a list can be switched on before you first log in, and can change after you have looked at it. That makes it a door worth asking about: ask your host whether it refuses bots by name, and if it does, ask for the four search names — OAI-SearchBot, Claude-SearchBot, PerplexityBot, Applebot — to be explicitly allowed for your site. One trap: if the host’s settings offer something between allow and block — a choice that refuses bots only sometimes, or when the site is under load — do not leave the search bots on it, however much it looks like the default; ask for the explicit allow. What that middle setting did on one of mine is below.

That is the check. Now what was behind mine.

Behind my own doors

All four of my sites sit on one Cloudflare account. On 10 September 2026 I tested all four from outside — asking each for a page that does not exist, under each bot’s published name, so no saved copy could answer for the site — and opened the settings wherever a probe said something was wrong.

Door 2 was shut on one site, and I had not shut it. On cryptowl.io every request I sent under an AI search bot’s name was turned away at the edge, Cloudflare’s own servers, before my site saw it, with Cloudflare’s refusal page: Your request was blocked. The same requests under Google’s and Bing’s names went through. The cause was the old radio button, set to Block on all pages — while the identical button on kovalseo.com read Block only on pages with ads, and since that site carries no ads, it blocked nothing. Same account, same person, opposite settings, neither chosen. And the button was the one labelled [Deprecating on September 15]. I set it to Do not block; by the 16th it was gone from all four sites, and cryptowl.io admitted every search name I sent. What it would have done to that site left on the block I cannot establish — and nobody would have told me. Had I not looked that day, I would not have known.

One limit. Every probe carried a bot’s name from my own machine, and Cloudflare’s page on the setting says it blocks training bots “as well as a number of unverified bots that behave similarly” — which a request from my machine wearing OAI-SearchBot’s name may well count as. Whether the real bot, arriving from OpenAI’s published addresses, met the same door, this test cannot say. What a shut Door 2 costs, if it did, is the vendor’s own sentence — OpenAI’s page describing its bots:

OpenAI’s page describing its bots

Sites that are opted out of OAI-SearchBot will not be shown in ChatGPT search answers, though can still appear as navigational links.

Door 1 was not the file I wrote. kovalseo.com’s robots.txt, in my code, is four lines — everyone welcome, and a sitemap, the list of my pages. What the public received on 10 September was 1,902 bytes: a page of Cloudflare’s own comments, then a block headed # BEGIN Cloudflare Managed content with Disallow: / for nine names — Amazonbot, Applebot-Extended, Bytespider, CCBot, ClaudeBot, CloudflareBrowserRenderingCrawler, Google-Extended, GPTBot, meta-externalagent — and my four lines underneath. Cloudflare “will prepend our managed robots.txt before your existing robots.txt, combining both into a single response”, says its documentation. The switch behind it was on, and I do not remember turning it on; who set it, I could not establish. Cloudflare’s own blog says it will be “encouraging every new site that onboards to Cloudflare to enable our managed robots.txt”. (Who else writes into this file, I have told once already.) On the 15th the block went: the next day my file was 66 bytes, my own lines and nothing above, and Cloudflare’s own demonstration site, www.crawlstop.com, had lost its block too — so the change was theirs, not mine. The switch is now Bot Preference Sync; it prepends what the three rows say, and mine say Allow. And the same documentation says what that file is worth at the door:

Cloudflare’s documentation on its managed robots.txt

robots.txt compliance is voluntary. The file expresses your preferences, but it does not prevent crawlers from accessing your content at a technical level.

Door 3 stood on a setting nobody had chosen. My hosting company keeps, for each site, a list of bots it refuses by the name they announce, and a bot set to block gets a 403. Each name on the list has three settings: allow, block, and a third between them whose name amounts to block when the site is under increased load. It looks like the do-nothing default. It is not. On kovalseo.com, over three days, the host’s own counter showed Applebot — Apple’s search bot — admitted 2 times and refused 13 while it sat on that third setting; Google’s bot, explicitly allowed, read 20 admitted and none refused. Nobody had chosen either. (The refused column may count refusals from the host’s other protections, or from the site itself, so I can say only that the counter showed them while the bot sat there.) The same list admitted ClaudeBot, which the site’s robots.txt asks to stay out — the host and the file disagreed. And the list moves: the host has added AI bots to what it blocks by default more than once, OpenAI’s search bot among them. Where a brand-new site’s default stands today I did not establish. Once the change had settled, every search bot passed every probe I sent — four to ten each.

How to know the door is really open

Settings prove settings, not the outcome. Two things prove more.

The test I ran takes one request — the last line of the message above, if it is not yours to make — and the answer reads as decoded there. Its limit: it proves what a program claiming the name receives; a rule that checks where a request truly comes from, not just the label it announces, could answer the real bot differently. And send more than one: while a change at my host spread across its servers, the same bot was refused and admitted minutes apart.

The closest thing to a receipt is in Cloudflare, under AI Crawl Control → Metrics: the answer codes, grouped 2xx to 5xx, that requests under each bot’s name received. Though on the free plan — Cloudflare’s no-cost tier — its documentation says “the Metrics tab only displays metrics for the past 24 hours”, so look the day after you change anything. One caution: on the free plan Cloudflare identifies these bots “based on their user agent strings” — the label a visitor announces itself with — and on one of my sites most of what that screen counted as AI bots turned out to be other programs wearing their names.

Then give the vendors their time. OpenAI’s page describing its bots: “it can take ~24 hours from a site’s robots.txt update for our systems to adjust.” When that day has passed, ask ChatGPT what your customer asked it.

What I cannot tell you is whether my sites now appear in ChatGPT’s answers. Nothing above measures that, I have not sat watching for my own name, and OpenAI’s own sentence stops at eligible — placement, it said in that section, is not guaranteed. The doors decide only whether the question can be asked.

There was never a form

The pages that told you so were right. They stopped one sentence early. Between your business and any answer ChatGPT gives stands a program that has to be let in, and three parties hold the doors: a file that other people write into, a service with defaults you never saw, and a host with a list that was on before you arrived. Mine had been set by others, and by me not once — and one of the three changed under me the day after this went up, on a date printed only on a screen I had never opened. Open yours, or send the message. Then go and be worth recommending.

Written by Oleh Koval at Specia1ne, who reads these reports for a living.