Free tool

Who really visits you

Your site's access log says which AI bots come by. But anyone can write “GPTBot” in a user agent: only the IP tells you whether the request really came from OpenAI. Choose the file or paste the lines, and we check every visit against the ranges the operators publish — all in your browser.

Your log never leaves your computer. We read the file here, in the browser; all we ask our server for are the IP ranges the operators publish, which are the same for everyone.

Apache or Nginx (combined), Cloudflare or Vercel JSON, also as .gz. Above 50 MB, we read the last 50 MB (the first 50 MB of a .gz).

One line per request, as they appear in the file.

The three states of a visit

  • Verified

    The IP is in the ranges the operator publishes for that bot. It is the real one.

  • IP outside the ranges

    The request carries the bot's name, but the IP is not the operator's. Most likely someone is using its name, though it is not certain: the lists change, and a proxy in front of your server hides the real IP.

  • No range list

    We have no list of this bot's ranges that we can read, so the IP neither confirms nor rules it out. The table links to the operator's documentation.

Where the ranges come from

From our bot registry: 17 have IP ranges published by their operator (OpenAI, Anthropic, Perplexity, Google, Microsoft, Apple, DuckDuckGo, Mistral AI and Common Crawl). Your browser asks our server for them, and our server fetches them from the operators once a day. That request is the same for everyone and carries nothing from your log.

Each line's bot is recognised by the name in its user agent, using the registry's names and no others. A hyphenated sub-name counts as the registry one, as in robots.txt: Googlebot-Image is Googlebot.

A verified bot getting a 403 on almost everything is a real block

The diagnostic tests your site with requests of our own, under each bot's name. The log shows the other side: what your server answered the real bot. If the verified PerplexityBot gets a 403 on most requests, your firewall is shutting it out, whatever robots.txt says. A 403 on just a few pages (/wp-admin/, a protected file) is something else: those pages are closed, and the checker tells you which.

Which logs it reads

  • Apache and Nginx

    The combined format, Nginx's default and the most common on Apache, with or without the host in front and extra fields at the end. common is read too, but it has no user agent.

  • Cloudflare

    Logpush JSON, one object per line, with the ClientIP, ClientRequestUserAgent, ClientRequestPath, EdgeResponseStatus and EdgeStartTimestamp fields.

  • Vercel

    Log drain JSON, one object per line. Build and function entries are left out.

Where your log is

On your own server, at /var/log/nginx/access.log or /var/log/apache2/access.log; older ones come as .gz, and those are read too. On shared hosting, look in the control panel (cPanel calls it “Raw Access”). If your site is behind Cloudflare, your server's log may hold Cloudflare's IP instead of the bot's: use the Logpush one.

What this checker does not do

  • It does not send your log

    The file is read in your browser, and nothing inside it leaves: not the IPs, not the pages, not the user agents.

  • It does not do reverse DNS

    Google, Microsoft and Common Crawl also confirm their bots by the IP's hostname. A browser cannot run that lookup; here, bots are confirmed by the ranges only.

  • It does not keep anything

    Close the page and the result goes with it. To keep it, copy the summary, which carries no IPs.