Skip to main content

RankSenseAi

Robots.txt & XML Sitemap Guide 2026: Rules for Google, AI Search and LLM Crawlers

A practical, step-by-step playbook to control what search engines and AI systems can crawl, find and cite, with real examples, common errors, a ready-to-use template and the best tools.

Updated October 2026Technical SEOAEO & GEO ready12 min read

Quick answer

  • robots.txt tells crawlers which URLs they may fetch. It does not keep pages out of the index and it is not a security tool.
  • An XML sitemap tells crawlers which canonical, indexable URLs you want discovered, and when they last changed.
  • For AI search: allow search and citation bots (OAI-SearchBot, Claude-SearchBot, PerplexityBot), and decide separately on training bots (GPTBot, ClaudeBot, Google-Extended, CCBot).
  • Both files must agree. Never list a URL in your sitemap that robots.txt blocks.

What robots.txt does

Robots.txt is a plain-text file at the root of your host (for example https://www.example.com/robots.txt) that gives crawl instructions to bots. It follows the Robots Exclusion Protocol (RFC 9309) and is the first file a well-behaved crawler requests.

It controls crawling, not indexing. A blocked URL can still appear in results as a bare link if other sites point to it, and a blocked page can never show a noindex tag because the crawler cannot read it. If you want a page out of search, allow crawling and serve noindex instead. This is the core idea behind our site crawlability and indexation guide.

Use it to

Save crawl budget on cart, checkout, internal search, filters and duplicate parameters. Set bot-specific policies. Point to your sitemap.

Don’t use it to

Hide private data, remove pages from Google, or enforce security. Anyone can read the file and bad bots ignore it.

Remember

One file per host and protocol. A subdomain needs its own robots.txt.

Robots.txt rules to remember

The rulebook
  • The file must be named robots.txt, UTF-8 plain text, at the root, returning 200. Google reads only the first 500 KiB.
  • Supported directives for Google: User-agent, Allow, Disallow, Sitemap. Google ignores Crawl-delay (Bing honours it).
  • A crawler obeys only the most specific matching group. If a User-agent: GPTBot group exists, the * group no longer applies to it, so repeat any shared rules.
  • Rules are prefix matches and case-sensitive. Disallow: /search also blocks /search-tips.
  • The longest (most specific) matching rule wins; on a tie, Allow beats Disallow.
  • Wildcards: * matches any sequence, $ anchors the end of a URL.
  • User-agent tokens are product names only: dotbot, not dotbot/1.0.
  • noindex inside robots.txt is not supported (Google ended this in 2019).
  • A 5xx response can make Google pause crawling the whole site. Keep the file highly available.
  • Never block CSS, JS or images that pages need to render.

Example: wildcard and exact-match rules

User-agent: *
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/
Disallow: /search/
Disallow: /*?*sort=
Disallow: /*?*sessionid=
Allow: /search/help$

Sitemap: https://www.example.com/sitemap.xml

Common robots.txt errors and fixes

These come from real technical audits of large B2B e-commerce sites, the same checks we run in our SEO audit services.

ErrorWhy it is a problemFix
No Sitemap: lineCrawlers miss your sitemap unless you submit it manually.Add the absolute HTTPS sitemap URL.
Invalid token such as dotbot/1.0The group never matches, so the bot is not blocked.Use the bare token: dotbot.
Fragile query rule: Disallow: /page?CSRFTokenMatches only when the parameter comes first.Disallow: /page?*CSRFToken=, and stop exposing tokens in URLs.
Inconsistent trailing slashes (/search vs /cart/)Over-blocks similar paths or misses the slashless URL.Decide intent: /search/, /search? or /search$.
No parameter or facet controlSort, filter and session URLs waste crawl budget.Wildcard rules plus canonical tags.
Blocking pages you want to rankBlocked pages cannot be crawled or fully evaluated.Audit every Disallow against your revenue pages.
Using Disallow to deindexURL may stay indexed without a snippet.Allow crawl and use noindex or authentication.
Path case mismatch/productCompare does not block /productcompare.Match live casing or redirect to one version.
Stale 2010s bot listsDead bots add clutter; real scrapers ignore robots.txt.Prune, then use WAF or rate limits for abusers.
No AI crawler policyYou have no deliberate stance on training or citation.Use the AI policy in the next section.

Robots.txt for LLMs and AI crawlers

AI companies now run separate bots for training, search indexing and user-triggered fetching. Blocking the wrong one can remove you from AI answers or do nothing at all. This is the foundation of generative engine optimization (GEO) and answer engine optimization (AEO).

TypeBotsWhat it doesRecommended default
Search / citationOAI-SearchBot, Claude-SearchBot, PerplexityBotBuilds the index that AI assistants cite in answers.Allow if you want AI visibility
TrainingGPTBot, ClaudeBot, CCBot, Bytespider, meta-externalagent, Applebot-ExtendedCollects content to train models.Business decision. Blocking does not remove you from AI search.
User-triggered fetchChatGPT-User, Claude-User, Perplexity-UserFetches a page when a person asks the assistant to.Allow. Vendors say these may not follow robots.txt.
Opt-out tokenGoogle-ExtendedNot a crawler. A robots.txt switch for Gemini training and grounding.Your call. It does not affect Google Search or AI Overviews.
Key facts
  • Google AI Overviews and AI Mode use the normal Googlebot index. To appear, a page must be crawlable, indexable and snippet-eligible.
  • Blocking only GPTBot does not hide you from OAI-SearchBot or ChatGPT-User. They are separate.
  • Robots.txt is advisory. Unidentified scrapers ignore it, so use WAF rules, rate limits and bot verification (reverse DNS or published IP ranges).
  • Vendors change user-agents. Re-check their documentation every quarter.

Template: visible in AI search, opted out of training

# Search engines and AI citation bots: allowed
User-agent: Googlebot
User-agent: Bingbot
User-agent: OAI-SearchBot
User-agent: ChatGPT-User
User-agent: Claude-SearchBot
User-agent: Claude-User
User-agent: PerplexityBot
Allow: /
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/

# Training crawlers: blocked (policy choice)
User-agent: GPTBot
User-agent: ClaudeBot
User-agent: CCBot
User-agent: Google-Extended
User-agent: Applebot-Extended
User-agent: Bytespider
Disallow: /

# Everyone else
User-agent: *
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/
Disallow: /search/

Sitemap: https://www.example.com/sitemap.xml
Which policy fits you? SaaS and B2B brands that want citations usually allow everything except low-value scrapers. Publishers with licensed content often block training bots but keep search bots. Whatever you choose, write it down and review it twice a year. Our AI search visibility guide covers the measurement side.

Step-by-step robots.txt setup

  1. Inventory your URLs. List the sections that waste crawl budget (cart, internal search, filters, sessions) and those that earn revenue.
  2. Check your current file. Open /robots.txt on every host and subdomain, and note the status code.
  3. Write rules by intent. Use trailing slashes, wildcards and $ deliberately, then add Allow exceptions.
  4. Set your AI policy. Decide search, training and user-fetch bots separately.
  5. Add the Sitemap line with an absolute HTTPS URL.
  6. Test before deploying. Use the Search Console robots.txt report and a crawler such as Screaming Frog in robots-testing mode.
  7. Deploy and monitor. Watch server logs for the bots you care about and confirm they follow the new rules.

What an XML sitemap does

An XML sitemap is a machine-readable list of the canonical URLs you want search engines to discover, with optional last-modified dates. It helps most on large, new or poorly interlinked sites, which includes almost every e-commerce catalog. It is a hint, not a guarantee of indexing.

A sitemap index lets you split a big site into several child files:

<?xml version="1.0" encoding="UTF-8"?>
<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <sitemap>
    <loc>https://www.example.com/sitemaps/products-1.xml</loc>
    <lastmod>2026-10-22T09:30:00+00:00</lastmod>
  </sitemap>
  <sitemap>
    <loc>https://www.example.com/sitemaps/categories.xml</loc>
    <lastmod>2026-10-20T14:05:00+00:00</lastmod>
  </sitemap>
</sitemapindex>

Sitemap rules to remember

The rulebook
  • Maximum 50,000 URLs or 50 MB uncompressed per file. Use a sitemap index beyond that.
  • Use absolute URLs with the same protocol and host as the sitemap. Use https:// if the site is HTTPS.
  • List only canonical, indexable, 200-status URLs. No redirects, 404s, noindex pages or URLs blocked in robots.txt.
  • <lastmod> must reflect a real content change. Google ignores it if it is inaccurate. <priority> and <changefreq> are ignored.
  • Keep sitemap URLs stable. Avoid hash-based or ID-based filenames that change on every build.
  • Segment by type (products, categories, content, images) so Search Console coverage is easy to read.
  • Declare it in robots.txt and submit it in Google Search Console and Bing Webmaster Tools.
  • For multilingual sites, use hreflang annotations consistently with the sitemap.

Common sitemap errors and fixes

ErrorWhy it is a problemFix
http:// URLs on an HTTPS siteForces redirects and sends a mixed protocol signal.Set the base URL to HTTPS in the generator.
Stale or identical lastmod on every entryLooks like generation time, so engines stop trusting it.Use true per-URL change dates and fix the cron job.
Child sitemaps in /medias/…/hash/file.xml.gzURLs change on every rebuild and history is lost.Serve from clean static paths via a rewrite.
Wrong locale or currency in the file name (e.g. EUR on a US site)May indicate the wrong site context was generated.Regenerate for the right site config and verify URLs.
No product sitemap on a catalog siteYour most valuable URLs may never be submitted.Add chunked product sitemaps under 50,000 URLs.
One-URL “homepage” sitemapExtra fetch, no benefit, noisy reporting.Merge into a core pages sitemap.
Vague “Custom” sitemapHard to audit and may hide non-indexable URLs.Audit contents and rename by purpose.
Sitemap not in robots.txtSlower discovery by non-Google bots.Add the Sitemap: directive.

Step-by-step sitemap setup

  1. Crawl your site and export every URL with status, canonical and indexability.
  2. Keep only index-worthy URLs. Remove redirects, errors, duplicates, parameters and noindex pages.
  3. Segment into files by template: products, categories, articles, images.
  4. Automate generation in your CMS and set lastmod from the real update timestamp.
  5. Publish at stable URLs and reference the index in robots.txt.
  6. Submit and monitor in Search Console and Bing Webmaster Tools. Compare “submitted” with “indexed” per sitemap.
  7. Re-audit monthly. Pair this with our technical SEO audit guide and the full technical SEO guide 2026.

What about llms.txt?

llms.txt is a proposed Markdown file that points AI agents to your most useful pages. It is cheap to add and sometimes read by agent tools, but no major search engine has confirmed it as a ranking or citation signal. Treat it as optional. Strong crawlability, clean sitemaps, structured data, clear answers and trusted mentions matter far more. See our AI SEO beginner’s guide for what actually earns citations.

Quick AEO and GEO checklist: server-render key content, keep answers in the first 40 to 60 words under question-style headings, add schema (Article, FAQPage, Product, Organization), show author and date, and track AI referrals with this GA4 AI traffic guide.

Best tools for robots.txt, sitemaps and AI crawler control

Prices were checked in October 2026 and change often. Confirm on each vendor’s site before buying.

ToolBest forPositivesNegativesPricing
Google Search ConsoleRobots.txt report, sitemap submission, index coverageFree, first-party data, URL InspectionGoogle only, limited history, no AI-bot dataFree
Bing Webmaster ToolsBing and Copilot discovery, sitemap and IndexNowFree, fast URL submissionSmaller reports than GSCFree
Screaming Frog SEO SpiderAuditing robots rules, sitemap URL status, canonicalsIndustry-standard crawler, custom robots testing, sitemap generationDesktop app, steep learning curveFree up to 500 URLs; about £199 (≈$279) per year
SitebulbVisual technical audits with prioritised hintsClear reports, easy for clientsLess flexible than Screaming Frog for custom workPaid from roughly $14 per month (verify current plans)
Ahrefs (Webmaster Tools / Site Audit)Site audits plus backlink and AI visibility dataFree tier for verified sites, large link indexFull suite is costlyWebmaster Tools free; paid from $129 per month (Lite)
SemrushAll-in-one audits, crawl scheduling, AI visibility add-onsBroad toolset, scheduled auditsAdd-ons raise cost; steeper learning curveFrom about $139.95 per month (Pro, monthly)
Cloudflare (AI crawl controls, WAF)Enforcing AI bot policy beyond robots.txtBlocks or rate-limits bots at the edge, bot analyticsNeeds DNS on Cloudflare; features vary by planFree tier available; check current plans
ai.robots.txt (GitHub list)Up-to-date list of 150+ AI user-agentsCommunity-maintained, ready-made configsBlocks by default, so review before useFree
Rank Math / Yoast SEO (WordPress)Editing robots.txt and generating sitemaps in WordPressOne-click sitemap, robots editorPlugin conflicts can create duplicate sitemapsFree core plugins; paid tiers available
RankSenseAI Free AI Citation CheckerChecking whether AI systems cite your brandFree, built for SaaS and B2B visibilityFocused on citations, not crawl diagnosticsFree
RankSenseAI AI Visibility Audit toolMeasuring visibility across Google AI and chat assistantsConnects crawl access to AI visibility gapsNot a full crawlerSee the tool page for current access
RankSenseAI AEO Analysis and SaaS Visibility CheckerAnswer-readiness and SaaS brand visibility checksQuick checks that feed your content fixesComplements, not replaces, enterprise suitesSee the tool pages for current access
RankSenseAI tools you can use today

Frequently asked questions

Does robots.txt remove a page from Google?

No. It only blocks crawling. To remove a page, allow crawling and add a noindex tag or header, or require authentication.

Should I block GPTBot and ClaudeBot?

It is a policy choice. Blocking training bots does not remove you from AI search, because search bots such as OAI-SearchBot and Claude-SearchBot are separate. Allow those if you want citations.

Does blocking Google-Extended hurt my Google rankings or AI Overviews?

No. Google-Extended only controls use of your content for Gemini training and grounding. Search and AI Overviews rely on Googlebot.

Do all AI bots obey robots.txt?

Reputable named crawlers generally do. User-triggered fetchers and unidentified scrapers may not, so add WAF rules and rate limits for enforcement.

How often should I update my sitemap?

Automatically, whenever content changes. Set lastmod only when a page meaningfully changes, and audit the files monthly.

Does every site need an XML sitemap?

Small, well-linked sites can rank without one, but a sitemap speeds discovery and gives you indexing diagnostics, so it is worth having on any site.

Want your robots.txt and sitemaps audited for Google and AI search?

RankSense AI reviews crawl rules, sitemap health and AI crawler policy, then gives you a prioritised fix list.

Get a free SEO audit Explore technical SEO services
Irfan
Author: Irfan

Irfan Dar is an SEO professional with 4+ years of experience in SEO, performance marketing, and digital analytics. He specializes in technical SEO, content strategy, on-page optimization, keyword research, AEO (Answer Engine Optimization), and GEO (Generative Engine Optimization). At RankSenseAI, Irfan focuses on helping businesses improve their visibility across traditional search engines and emerging AI search platforms. His work covers technical SEO, content optimization, AI search visibility, structured data, entity optimization, and strategies designed to help brands get discovered across search experiences such as Google AI Overviews, ChatGPT, and other AI-powered platforms. He also works with tools and platforms including Google Search Console, GA4, Google Tag Manager, SEMrush, Screaming Frog, Google Ads, Meta Ads, and Looker Studio. Irfan believes effective SEO is not just about rankings. It is about creating useful, technically sound content and building the signals that help search engines and AI systems understand, trust, and surface a brand.