Study 01 · Global Digital Authority Benchmark Series · United States 2026

Over 2 in 5 US business websites with an observable crawler policy block the AI crawlers they need

A structured benchmark of 808 publicly identifiable US business websites (commercial operating entities) across 10 industry groups, measuring which AI search crawlers can — and cannot — access them.

Author Douglas Lord
Research instrument PTODA C01 Crawler v1.2 — deterministic robots.txt scanner
Commercial operator AUTHORITY44™
Scan date 17 June 2026, ET
Sample 808 domains · 10 sectors · 619 with readable robots.txt policy
42%
of US business domains with a readable robots.txt file block at least one AI retrieval crawler

Of 619 domains whose crawler policy could be directly observed, 261 — 42.2% — block at least one crawler used by AI search systems to discover and cite content.

We separate observable AI-crawler policy from infrastructure non-response. A block declared in robots.txt is a policy decision; a 403, timeout or unscannable response is an access outcome, not evidence of crawler policy. These are reported separately below.

Of the blocked sites, 89.7% are broad access restrictions catching AI crawlers incidentally rather than AI-specific decisions.

Key findings

The numbers at a glance

Policy-layer figures are based on 619 domains whose robots.txt was successfully retrieved and parsed. A further 189 domains returned no observable policy (146 access-denied, 43 unscannable) and are reported separately in the Infrastructure layer section. They are not counted as open or blocked.

57.8%
Open to all AI crawlers
358 of 619 policy-observed sites, with no robots.txt restriction preventing AI search discovery
34.7%
Fully blocked to all AI crawlers
215 sites block all tested retrieval crawlers
7.4%
Partially blocked
46 sites block some crawlers but not all
89.7%
Broad blocks — not targeted at AI
234 of 261 blocked sites also block Googlebot, so the block is a broad restriction rather than an AI-specific decision
10.3%
Deliberate AI-only blocks
27 sites specifically blocked AI crawlers while keeping Googlebot accessible
21
AI crawlers tested
14 retrieval (Group A) and 7 training (Group B) user-agents, the harmonised series crawler set

The central finding: Most blocked businesses are not actively choosing to exclude AI search. They have broad access restrictions set years ago that are now inadvertently catching AI crawlers. This is a configuration problem, not a strategic decision.

Infrastructure layer

Access outcomes — not crawler policy

We separate observable AI-crawler policy from infrastructure non-response. A block in robots.txt is a policy decision. A 403, timeout or unscannable response is an access outcome, not evidence of crawler policy. These 189 domains are reported here and excluded from every policy-layer figure.

146
Access denied (HTTP 403/401/429)
18.1% of the 808 domains approached — the highest in the series. The edge (WAF / managed CDN) actively refused the robots.txt request, so no crawler policy could be observed. Not counted as open or blocked.
43
Unscannable
5.3% of domains approached. No readable response through connection failure, timeout or 5xx error. No policy observable.
619
Policy observed
76.6% of domains approached returned a readable robots.txt. This is the denominator for all policy-layer findings on this page.

Why this matters: a domain that denies the crawler at the infrastructure layer has not expressed an AI-crawler policy — it has prevented one from being read. Treating such a response as “open” would overstate access; treating it as “blocked” would overstate restriction. Reporting it separately keeps the policy-layer figures based only on directly observed robots.txt behaviour.

The US signature: active edge denial. The United States stands apart from the other markets in the series. Its non-response is dominated by access denial (146 domains, 18.1%, the highest measured) rather than passive non-response, and that denial carries a managed-WAF signature: of the access-denied domains, Cloudflare (41) and Akamai (26) account for the largest identifiable share. This is the fingerprint of deliberate bot mitigation: enterprise edge platforms returning 403 to automated requests, not infrastructure that simply failed to respond. By contrast, the other markets show the inverse pattern: more passive timeouts, fewer active denials, and no managed-CDN concentration. How access is restricted, not only how much, differs by market.

Block origin

Intentional vs infrastructure-imposed

Of the 261 sites blocking AI retrieval crawlers, the source of the block was classified into three categories.

65.5%
Explicit — author-set
171 sites. Block is in the site's own robots.txt. May be intentional or legacy configuration.
30.7%
Indeterminate
80 Cloudflare-hosted sites without a managed-robots signature. Likely explicit blocks — cannot be confirmed by automated analysis alone.
3.8%
Infrastructure-imposed
10 sites. Block originates from Cloudflare's managed robots.txt feature — a platform default the owner may never have consciously set.

The infrastructure-imposed subset is the most commercially significant finding: these site owners may be blocking AI search discovery without ever having made that decision. The indeterminate category — 80 Cloudflare-hosted sites — most likely represents explicit blocks, but the configuration path cannot be confirmed by automated means alone.

Sector analysis

Block rates by industry

Block rates vary across the 10 sectors. Retail & Ecommerce and Hospitality & Tourism are highest; Building & Trades lowest. Rates are computed on policy-observed domains per sector (readable robots.txt only).

% blocking ≥1 retrieval crawler (of policy-observed domains per sector)
Retail & Ecommerce
56.2%
Hospitality & Tourism
53.8%
Education & Training
47.0%
Legal
45.2%
Technology & SaaS
44.9%
Healthcare
40.7%
Real Estate
39.0%
Accounting & Finance
37.3%
Professional Services
36.1%
Building & Trades
23.2%

Retail & Ecommerce at 56.2% and Hospitality & Tourism at 53.8% are the highest-blocking US sectors. Both are consumer-facing industries where content protection and bot-mitigation are common. Technology & SaaS at 44.9% remains a counterintuitive result: the sector most aware of AI is among the more likely to be invisible to it. Building & Trades at 23.2% is the most open — consistent across every market in the series.

Per-crawler analysis

Which crawlers are blocked most

Group A (retrieval/citation crawlers) drives the headline finding. Group B (training crawlers) is reported separately, because blocking training crawlers is often a deliberate and legitimate content-protection decision.

Group A — Retrieval & Citation Crawlers (14 tested)
GPTBot OpenAI39.6%
ClaudeBot Anthropic39.3%
Claude-SearchBot Anthropic39.3%
DuckAssistBot DuckDuckGo39.3%
Claude-Web Anthropic39.1%
MistralAI-User Mistral39.1%
PerplexityBot Perplexity38.3%
Googlebot baseline37.8%
Group B — Training Crawlers (7, separate)
meta-externalagent Meta40.9%
Bytespider ByteDance40.7%
Amazonbot Amazon40.7%
Applebot-Extended Apple40.4%
CCBot Common Crawl40.1%
FacebookBot Meta39.4%
Google-Extended Gemini training38.9%

The Googlebot parity finding holds in the US. Googlebot is blocked at 37.8%, right alongside the AI retrieval crawlers (GPTBot 39.6%, ClaudeBot 39.3%). Most US AI-crawler blocks are broad restrictions, not targeted AI decisions. The 14 retrieval crawlers cluster tightly (37.8%–39.6%), indicating that where AI is blocked, it is typically blocked uniformly across operators rather than selectively.

Platform analysis

CMS correlation

Block rates by content management system among policy-observed domains. WordPress and Drupal both have substantial bases in the US sample; the others rest on small samples and should be read with caution.

Block rate by detected CMS (policy-observed domains)
WordPress
36.9% (n=84)
Webflow
25.0% (n=4)
Drupal
14.8% (n=54)

Most sites return no identifiable CMS signature, so platform-level rates are based on the minority that do. WordPress at 36.9% (n=84) tracks close to the overall sample average, the broadest cross-section of US business websites. Drupal at 14.8% (n=54) is markedly lower, and with 54 sites this is a reliable signal: Drupal's heavy enterprise and government skew means robots.txt is more deliberately and conservatively managed, producing fewer broad AI blocks. Webflow (n=4), Wix, Joomla and Shopify have too few domains in this sample to report a meaningful rate.

Methodology

How this study was conducted

Study specification

Methodology version
PTODA C01 Crawler Methodology (v1.2, June 2026). Citeable, versioned specification covering sample criteria, the 21-user-agent crawler list, classification logic, and the policy/infrastructure layer split.
Research instrument
PTODA C01 Crawler v1.2 — a deterministic robots.txt scanner. Same input produces the same result; the study is reproducible by re-running the instrument against the published sample.
Sample
808 publicly identifiable US business websites (commercial operating entities) across 10 industry groups, sourced from named public directories. Portals, aggregators, government, industry bodies, research institutes and not-for-profits are excluded under the harmonised series entity-type rule. No client sites. No sites selected by outcome.
Sectors
Retail/Ecommerce, Real Estate, Legal, Healthcare, Building/Trades, Accounting/Finance, Hospitality/Tourism, Education/Training, Technology/SaaS, Professional Services
Measurement
Public robots.txt parsed per user-agent across 21 AI crawlers (14 retrieval, 7 training). Homepage meta robots and X-Robots-Tag headers examined. CMS and CDN/host detected from homepage signals.
Bot identity
PTODA-C01-Crawler/1.2 — identified honestly in every request. robots.txt respected; polite rate limits applied.
Scan date
17 June 2026, ET. Point-in-time snapshot.
False positive prevention
WordPress /wp-admin/ disallows, Crawl-delay directives, and sitemap declarations explicitly excluded from blocked classification. Validated against 14 fixture tests before batch ran.
URL structure
Root-level domains only. Businesses whose primary US presence is a sub-path of an international domain were replaced with root-domain equivalents. Some businesses that would otherwise qualify are not included.
Policy vs infrastructure layers
Of 808 domains approached, 619 returned a readable robots.txt policy (the policy-layer denominator). 189 returned no observable policy and are reported separately: 146 access-denied (HTTP 403/401/429 at the edge — the highest in the series) and 43 unscannable (connection failure, timeout or 5xx). Access-denied and unscannable domains are never counted as open or blocked.

Series freeze reference

Dataset version
AI Crawler Access Study Series v1.2 — frozen 17 June 2026. The authoritative dataset for the Australia, United States, Great Britain and Singapore comparative analysis. All figures on this page derive from the v1.2 series master; figures published under v1.0 are superseded.
Limitations

Caveats

Disclosure & Intellectual Property

Roles. This study is published by the Periodic Table of Digital Authority (PTODA), the methodology owner. It was conducted using the PTODA C01 Crawler v1.2, a deterministic robots.txt reference instrument, under PTODA C01 Crawler Methodology v1.2. AUTHORITY44 provided technical infrastructure and execution support as commercial operator. Douglas Lord is the founder of both PTODA and AUTHORITY44; this relationship is disclosed in full. The sample was constructed from named public directories with no reference to commercial relationships. The methodology is fully documented and reproducible. This study publishes aggregate, anonymised findings only. No named individual site results are published.

Attribution chain: Douglas Lord (researcher, author) · Periodic Table of Digital Authority (publisher & methodology owner) · PTODA C01 Crawler v1.2 (research instrument) · AUTHORITY44™ (commercial operator) · Digital Dominator Pty Ltd ABN 28 616 931 116 (operating entity).

Intellectual property notice: This study, its methodology, findings, data, and all associated content are the original work of Douglas Lord and the property of Digital Dominator Pty Ltd (ABN 28 616 931 116). The Periodic Table of Digital Authority™ is a coined framework and trade mark pending (TM 2644497). AUTHORITY44™ is a trade mark pending (TM 2643932). All rights reserved.

You may cite findings from this study with appropriate attribution identifying the author (Douglas Lord), the publisher (Periodic Table of Digital Authority — periodictableofdigitalauthority.com), and the research instrument (PTODA C01 Crawler v1.2). You may not reproduce this study in full, present these findings as your own research, or use the framework name or trade marks without prior written consent. Use of this research is subject to the Terms of Use.