Robots.txt & XML Sitemap Guide 2026: Rules for Google, AI Search and LLM Crawlers
A practical, step-by-step playbook to control what search engines and AI systems can crawl, find and cite, with real examples, common errors, a ready-to-use template and the best tools.
Quick answer
- robots.txt tells crawlers which URLs they may fetch. It does not keep pages out of the index and it is not a security tool.
- An XML sitemap tells crawlers which canonical, indexable URLs you want discovered, and when they last changed.
- For AI search: allow search and citation bots (OAI-SearchBot, Claude-SearchBot, PerplexityBot), and decide separately on training bots (GPTBot, ClaudeBot, Google-Extended, CCBot).
- Both files must agree. Never list a URL in your sitemap that robots.txt blocks.
What robots.txt does
Robots.txt is a plain-text file at the root of your host (for example https://www.example.com/robots.txt) that gives crawl instructions to bots. It follows the Robots Exclusion Protocol (RFC 9309) and is the first file a well-behaved crawler requests.
It controls crawling, not indexing. A blocked URL can still appear in results as a bare link if other sites point to it, and a blocked page can never show a noindex tag because the crawler cannot read it. If you want a page out of search, allow crawling and serve noindex instead. This is the core idea behind our site crawlability and indexation guide.
Use it to
Save crawl budget on cart, checkout, internal search, filters and duplicate parameters. Set bot-specific policies. Point to your sitemap.
Don’t use it to
Hide private data, remove pages from Google, or enforce security. Anyone can read the file and bad bots ignore it.
Remember
One file per host and protocol. A subdomain needs its own robots.txt.
Robots.txt rules to remember
- The file must be named
robots.txt, UTF-8 plain text, at the root, returning200. Google reads only the first 500 KiB. - Supported directives for Google:
User-agent,Allow,Disallow,Sitemap. Google ignoresCrawl-delay(Bing honours it). - A crawler obeys only the most specific matching group. If a
User-agent: GPTBotgroup exists, the*group no longer applies to it, so repeat any shared rules. - Rules are prefix matches and case-sensitive.
Disallow: /searchalso blocks/search-tips. - The longest (most specific) matching rule wins; on a tie,
AllowbeatsDisallow. - Wildcards:
*matches any sequence,$anchors the end of a URL. - User-agent tokens are product names only:
dotbot, notdotbot/1.0. noindexinside robots.txt is not supported (Google ended this in 2019).- A
5xxresponse can make Google pause crawling the whole site. Keep the file highly available. - Never block CSS, JS or images that pages need to render.
Example: wildcard and exact-match rules
User-agent: *
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/
Disallow: /search/
Disallow: /*?*sort=
Disallow: /*?*sessionid=
Allow: /search/help$
Sitemap: https://www.example.com/sitemap.xml
Common robots.txt errors and fixes
These come from real technical audits of large B2B e-commerce sites, the same checks we run in our SEO audit services.
| Error | Why it is a problem | Fix |
|---|---|---|
No Sitemap: line | Crawlers miss your sitemap unless you submit it manually. | Add the absolute HTTPS sitemap URL. |
Invalid token such as dotbot/1.0 | The group never matches, so the bot is not blocked. | Use the bare token: dotbot. |
Fragile query rule: Disallow: /page?CSRFToken | Matches only when the parameter comes first. | Disallow: /page?*CSRFToken=, and stop exposing tokens in URLs. |
Inconsistent trailing slashes (/search vs /cart/) | Over-blocks similar paths or misses the slashless URL. | Decide intent: /search/, /search? or /search$. |
| No parameter or facet control | Sort, filter and session URLs waste crawl budget. | Wildcard rules plus canonical tags. |
| Blocking pages you want to rank | Blocked pages cannot be crawled or fully evaluated. | Audit every Disallow against your revenue pages. |
| Using Disallow to deindex | URL may stay indexed without a snippet. | Allow crawl and use noindex or authentication. |
| Path case mismatch | /productCompare does not block /productcompare. | Match live casing or redirect to one version. |
| Stale 2010s bot lists | Dead bots add clutter; real scrapers ignore robots.txt. | Prune, then use WAF or rate limits for abusers. |
| No AI crawler policy | You have no deliberate stance on training or citation. | Use the AI policy in the next section. |
Robots.txt for LLMs and AI crawlers
AI companies now run separate bots for training, search indexing and user-triggered fetching. Blocking the wrong one can remove you from AI answers or do nothing at all. This is the foundation of generative engine optimization (GEO) and answer engine optimization (AEO).
| Type | Bots | What it does | Recommended default |
|---|---|---|---|
| Search / citation | OAI-SearchBot, Claude-SearchBot, PerplexityBot | Builds the index that AI assistants cite in answers. | Allow if you want AI visibility |
| Training | GPTBot, ClaudeBot, CCBot, Bytespider, meta-externalagent, Applebot-Extended | Collects content to train models. | Business decision. Blocking does not remove you from AI search. |
| User-triggered fetch | ChatGPT-User, Claude-User, Perplexity-User | Fetches a page when a person asks the assistant to. | Allow. Vendors say these may not follow robots.txt. |
| Opt-out token | Google-Extended | Not a crawler. A robots.txt switch for Gemini training and grounding. | Your call. It does not affect Google Search or AI Overviews. |
- Google AI Overviews and AI Mode use the normal Googlebot index. To appear, a page must be crawlable, indexable and snippet-eligible.
- Blocking only
GPTBotdoes not hide you fromOAI-SearchBotorChatGPT-User. They are separate. - Robots.txt is advisory. Unidentified scrapers ignore it, so use WAF rules, rate limits and bot verification (reverse DNS or published IP ranges).
- Vendors change user-agents. Re-check their documentation every quarter.
Template: visible in AI search, opted out of training
# Search engines and AI citation bots: allowed
User-agent: Googlebot
User-agent: Bingbot
User-agent: OAI-SearchBot
User-agent: ChatGPT-User
User-agent: Claude-SearchBot
User-agent: Claude-User
User-agent: PerplexityBot
Allow: /
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/
# Training crawlers: blocked (policy choice)
User-agent: GPTBot
User-agent: ClaudeBot
User-agent: CCBot
User-agent: Google-Extended
User-agent: Applebot-Extended
User-agent: Bytespider
Disallow: /
# Everyone else
User-agent: *
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/
Disallow: /search/
Sitemap: https://www.example.com/sitemap.xml
Step-by-step robots.txt setup
- Inventory your URLs. List the sections that waste crawl budget (cart, internal search, filters, sessions) and those that earn revenue.
- Check your current file. Open
/robots.txton every host and subdomain, and note the status code. - Write rules by intent. Use trailing slashes, wildcards and
$deliberately, then addAllowexceptions. - Set your AI policy. Decide search, training and user-fetch bots separately.
- Add the Sitemap line with an absolute HTTPS URL.
- Test before deploying. Use the Search Console robots.txt report and a crawler such as Screaming Frog in robots-testing mode.
- Deploy and monitor. Watch server logs for the bots you care about and confirm they follow the new rules.
What an XML sitemap does
An XML sitemap is a machine-readable list of the canonical URLs you want search engines to discover, with optional last-modified dates. It helps most on large, new or poorly interlinked sites, which includes almost every e-commerce catalog. It is a hint, not a guarantee of indexing.
A sitemap index lets you split a big site into several child files:
<?xml version="1.0" encoding="UTF-8"?>
<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<sitemap>
<loc>https://www.example.com/sitemaps/products-1.xml</loc>
<lastmod>2026-10-22T09:30:00+00:00</lastmod>
</sitemap>
<sitemap>
<loc>https://www.example.com/sitemaps/categories.xml</loc>
<lastmod>2026-10-20T14:05:00+00:00</lastmod>
</sitemap>
</sitemapindex>
Sitemap rules to remember
- Maximum 50,000 URLs or 50 MB uncompressed per file. Use a sitemap index beyond that.
- Use absolute URLs with the same protocol and host as the sitemap. Use
https://if the site is HTTPS. - List only canonical, indexable, 200-status URLs. No redirects, 404s,
noindexpages or URLs blocked in robots.txt. <lastmod>must reflect a real content change. Google ignores it if it is inaccurate.<priority>and<changefreq>are ignored.- Keep sitemap URLs stable. Avoid hash-based or ID-based filenames that change on every build.
- Segment by type (products, categories, content, images) so Search Console coverage is easy to read.
- Declare it in robots.txt and submit it in Google Search Console and Bing Webmaster Tools.
- For multilingual sites, use
hreflangannotations consistently with the sitemap.
Common sitemap errors and fixes
| Error | Why it is a problem | Fix |
|---|---|---|
http:// URLs on an HTTPS site | Forces redirects and sends a mixed protocol signal. | Set the base URL to HTTPS in the generator. |
Stale or identical lastmod on every entry | Looks like generation time, so engines stop trusting it. | Use true per-URL change dates and fix the cron job. |
Child sitemaps in /medias/…/hash/file.xml.gz | URLs change on every rebuild and history is lost. | Serve from clean static paths via a rewrite. |
| Wrong locale or currency in the file name (e.g. EUR on a US site) | May indicate the wrong site context was generated. | Regenerate for the right site config and verify URLs. |
| No product sitemap on a catalog site | Your most valuable URLs may never be submitted. | Add chunked product sitemaps under 50,000 URLs. |
| One-URL “homepage” sitemap | Extra fetch, no benefit, noisy reporting. | Merge into a core pages sitemap. |
| Vague “Custom” sitemap | Hard to audit and may hide non-indexable URLs. | Audit contents and rename by purpose. |
| Sitemap not in robots.txt | Slower discovery by non-Google bots. | Add the Sitemap: directive. |
Step-by-step sitemap setup
- Crawl your site and export every URL with status, canonical and indexability.
- Keep only index-worthy URLs. Remove redirects, errors, duplicates, parameters and
noindexpages. - Segment into files by template: products, categories, articles, images.
- Automate generation in your CMS and set
lastmodfrom the real update timestamp. - Publish at stable URLs and reference the index in robots.txt.
- Submit and monitor in Search Console and Bing Webmaster Tools. Compare “submitted” with “indexed” per sitemap.
- Re-audit monthly. Pair this with our technical SEO audit guide and the full technical SEO guide 2026.
What about llms.txt?
llms.txt is a proposed Markdown file that points AI agents to your most useful pages. It is cheap to add and sometimes read by agent tools, but no major search engine has confirmed it as a ranking or citation signal. Treat it as optional. Strong crawlability, clean sitemaps, structured data, clear answers and trusted mentions matter far more. See our AI SEO beginner’s guide for what actually earns citations.
Article, FAQPage, Product, Organization), show author and date, and track AI referrals with this GA4 AI traffic guide.Best tools for robots.txt, sitemaps and AI crawler control
Prices were checked in October 2026 and change often. Confirm on each vendor’s site before buying.
| Tool | Best for | Positives | Negatives | Pricing |
|---|---|---|---|---|
| Google Search Console | Robots.txt report, sitemap submission, index coverage | Free, first-party data, URL Inspection | Google only, limited history, no AI-bot data | Free |
| Bing Webmaster Tools | Bing and Copilot discovery, sitemap and IndexNow | Free, fast URL submission | Smaller reports than GSC | Free |
| Screaming Frog SEO Spider | Auditing robots rules, sitemap URL status, canonicals | Industry-standard crawler, custom robots testing, sitemap generation | Desktop app, steep learning curve | Free up to 500 URLs; about £199 (≈$279) per year |
| Sitebulb | Visual technical audits with prioritised hints | Clear reports, easy for clients | Less flexible than Screaming Frog for custom work | Paid from roughly $14 per month (verify current plans) |
| Ahrefs (Webmaster Tools / Site Audit) | Site audits plus backlink and AI visibility data | Free tier for verified sites, large link index | Full suite is costly | Webmaster Tools free; paid from $129 per month (Lite) |
| Semrush | All-in-one audits, crawl scheduling, AI visibility add-ons | Broad toolset, scheduled audits | Add-ons raise cost; steeper learning curve | From about $139.95 per month (Pro, monthly) |
| Cloudflare (AI crawl controls, WAF) | Enforcing AI bot policy beyond robots.txt | Blocks or rate-limits bots at the edge, bot analytics | Needs DNS on Cloudflare; features vary by plan | Free tier available; check current plans |
| ai.robots.txt (GitHub list) | Up-to-date list of 150+ AI user-agents | Community-maintained, ready-made configs | Blocks by default, so review before use | Free |
| Rank Math / Yoast SEO (WordPress) | Editing robots.txt and generating sitemaps in WordPress | One-click sitemap, robots editor | Plugin conflicts can create duplicate sitemaps | Free core plugins; paid tiers available |
| RankSenseAI Free AI Citation Checker | Checking whether AI systems cite your brand | Free, built for SaaS and B2B visibility | Focused on citations, not crawl diagnostics | Free |
| RankSenseAI AI Visibility Audit tool | Measuring visibility across Google AI and chat assistants | Connects crawl access to AI visibility gaps | Not a full crawler | See the tool page for current access |
| RankSenseAI AEO Analysis and SaaS Visibility Checker | Answer-readiness and SaaS brand visibility checks | Quick checks that feed your content fixes | Complements, not replaces, enterprise suites | See the tool pages for current access |
- Free AI Citation Checker: see whether your pages are cited by AI answers.
- AI Visibility Audit tool: find crawl and content gaps that hurt AI visibility.
- AEO analysis tools: test how answer-ready your content is.
- SaaS Visibility Checker: benchmark your SaaS brand in AI search.
- Free content brief generator: turn gaps into answer-first briefs.
Frequently asked questions
Does robots.txt remove a page from Google?
No. It only blocks crawling. To remove a page, allow crawling and add a noindex tag or header, or require authentication.
Should I block GPTBot and ClaudeBot?
It is a policy choice. Blocking training bots does not remove you from AI search, because search bots such as OAI-SearchBot and Claude-SearchBot are separate. Allow those if you want citations.
Does blocking Google-Extended hurt my Google rankings or AI Overviews?
No. Google-Extended only controls use of your content for Gemini training and grounding. Search and AI Overviews rely on Googlebot.
Do all AI bots obey robots.txt?
Reputable named crawlers generally do. User-triggered fetchers and unidentified scrapers may not, so add WAF rules and rate limits for enforcement.
How often should I update my sitemap?
Automatically, whenever content changes. Set lastmod only when a page meaningfully changes, and audit the files monthly.
Does every site need an XML sitemap?
Small, well-linked sites can rank without one, but a sitemap speeds discovery and gives you indexing diagnostics, so it is worth having on any site.
Want your robots.txt and sitemaps audited for Google and AI search?
RankSense AI reviews crawl rules, sitemap health and AI crawler policy, then gives you a prioritised fix list.
Get a free SEO audit Explore technical SEO servicesAuthor: Irfan
Irfan Dar is an SEO professional with 4+ years of experience in SEO, performance marketing, and digital analytics. He specializes in technical SEO, content strategy, on-page optimization, keyword research, AEO (Answer Engine Optimization), and GEO (Generative Engine Optimization). At RankSenseAI, Irfan focuses on helping businesses improve their visibility across traditional search engines and emerging AI search platforms. His work covers technical SEO, content optimization, AI search visibility, structured data, entity optimization, and strategies designed to help brands get discovered across search experiences such as Google AI Overviews, ChatGPT, and other AI-powered platforms. He also works with tools and platforms including Google Search Console, GA4, Google Tag Manager, SEMrush, Screaming Frog, Google Ads, Meta Ads, and Looker Studio. Irfan believes effective SEO is not just about rankings. It is about creating useful, technically sound content and building the signals that help search engines and AI systems understand, trust, and surface a brand.