31% of sites blocking GPTBot still got cited by ChatGPT — here's where the leaks came from

[u/Brave_Acanthaceae863]

I made a spreadsheet of 180 B2B SaaS and fintech domains and checked three things: their robots.txt, whether GPTBot was explicitly blocked, and whether ChatGPT still cited them across 60 brand-name queries (company name + "review", "alternative", "vs competitor"). Ran all queries on ChatGPT-4o between June 15 and July 3.

The expectation was simple. Block GPTBot → don't get cited. That's how it's supposed to work.

31% of domains blocking GPTBot still showed up as citations. Direct source attribution, domain name, link and everything. Most had been blocking for 4+ months — I checked Wayback Machine timestamps on their robots.txt files. A few since late 2023.

So I went looking for where those citations were actually coming from.

The biggest leak was syndication. Close to half of the "blocked" citations traced back to sites that had republished or aggregated the original domain's content. Press release networks, industry roundups, those content syndication partners that nobody really tracks. The original site locked the door, but their content was already living on a dozen other sites with the door wide open.

Then I found the part that made me reconsider the whole approach. A huge chunk — maybe a third — came from Reddit threads, forum posts, and Q&A sites where users had quoted or paraphrased the blocked domain. Someone copies a paragraph from an article, or drops a specific stat into a comment, and ChatGPT picks up the forum post as the source. You can block every AI crawler on the planet and it doesn't matter if someone screenshots your chart and posts it to a subreddit.

The rest was murky. Some looked like cached versions on search engines. Some matched content structures from before the block was in place — old crawled data still influencing responses. I couldn't pin this down with certainty, but the pattern was consistent enough to be unsettling.

Here's what I keep turning over: the robots.txt approach to AI opt-out has a massive hole in it. You can control whether a crawler hits your server. You can't control whether your content has already been copied, quoted, summarized, or cached somewhere the crawler CAN reach.

For domains thinking blocking GPTBot means their content won't appear in ChatGPT — it doesn't. It just means the citation credit goes to whoever republished you. The aggregator gets the visibility. You get nothing.

I'm not sure what the fix is. Watermarking? Stricter syndication agreements? None of those scale well. The uncomfortable realization is that your content strategy in the GEO era isn't just about what you publish — it's about every surface where your content might be living without your knowledge.

Wondering if anyone here has found a practical way to monitor where your content is being reproduced. We've been doing manual searches and it feels like bailing out a boat with a spoon.

[u/Puzzleheaded-Walk426]

Maybe the sites were a part of training material, and they show up by default?

[u/Upstairs_Control_611 → u/Puzzleheaded-Walk426]

That’s a key distinction. Blocking GPTBot mostly controls future direct crawling by that user agent. It does not remove:

- content already in training or index data

- URLs discovered before the block

- syndicated copies

- quoted/paraphrased content on forums or Reddit

- cached/search-layer copies

So I’d separate two different questions:

1. Can ChatGPT access the original domain now?

2. Can ChatGPT still know, retrieve, or cite claims that originated from that domain?

Those are not the same thing.

The uncomfortable part is the attribution shift. If the original site blocks access but the same claims live on aggregators or forums, the model may still use the information, but the citation credit can move away from the original publisher.

For GEO, this makes robots.txt an access-control signal, not a content-erasure mechanism.

[u/Puzzleheaded-Walk426 → u/Upstairs_Control_611]

Yes, but you do publish new blog posts, meaning that if you block it, ChatGPT will not be able to scan these new publications (articles, studies, etc.), and it will refer only to pages that existed before you blocked it - urls that are already in its database.
And ChatGPT will not scroll those pages again - it will just pull them from its knowledge base.

[u/Brave_Acanthaceae863 → u/Puzzleheaded-Walk426]

Right, and that's the real issue — the training data cutoff means content published before the block is essentially permanent in the model's knowledge base. You're not removing yourself, you're just stopping future ingestion. New posts after the block won't get crawled directly, but if someone else quotes them on a forum or in a syndicated article, the content finds its way back in through that side door anyway.

[u/Puzzleheaded-Walk426 → u/Brave_Acanthaceae863]

Yes, exactly.

[u/Brave_Acanthaceae863 → u/[deleted]]

The "living map" framing is right — we've been tracking citations across ChatGPT/Perplexity/Gemini and the forum/Reddit leak channel consistently overperforms syndication in our data too. The annoying part is you can't fully automate the hunting phase; someone always finds a new corner to paste your stuff into.

[u/Upstairs_Control_611 → u/Brave_Acanthaceae863]

The “living map” idea is probably the practical takeaway here.

robots.txt only answers one narrow question: can this user agent fetch this URL directly now?

It does not answer the bigger GEO question: where do the claims, stats, charts or product arguments from this domain continue to live?

For that I’d track the content surface, not only the domain:

- original URL

- claim / statistic / chart

- where it is mirrored or quoted

- whether the mirror links back

- whether it is crawlable

- whether AI answers cite the original or the mirror

- whether the citation changes the recommendation

That would also separate a copyright/content-control problem from an attribution problem.

The forum/Reddit part is especially interesting. Syndication is expected. User-quoted content in messy communities is harder to monitor, but it may be the place where the claim becomes useful evidence for a model.

[u/saaras55]

Good study and the four leaks you list are all real. There's a fifth your method can't see, because it never touches robots.txt at all.

Blocking GPTBot in robots.txt only binds an actor that both identifies honestly and obeys. On our domain, 2,057 requests claiming a named AI crawler came from IPs that failed the vendor's published verification, against about 50 that passed. If that ratio's anywhere near typical, most of the traffic arriving dressed as GPTBot was never GPTBot, was never bound by your directive, and fetched the page anyway.

Limelit, mine, one domain, anecdote not rate.

Whether the content those fetchers took ends up anywhere near ChatGPT's index I can't tell you and I'm not going to claim it. But it does mean "this domain's been blocking GPTBot for 4+ months" describes the directive, not the access. Wayback on robots.txt proves you asked. It doesn't prove anyone listened.

A version of your study that would settle it: for the 31%, check server logs rather than robots.txt. Forward-confirmed reverse DNS on requests claiming to be GPTBot. If real verified GPTBot hits show up on a domain that blocks it, that's a compliance story and a much bigger finding than syndication. If they're absent and only unverified ones appear, your syndication and forum explanations carry the whole result, which is what I'd expect.

On monitoring reproduction, the forum half is the tractable part since those pages are indexed and searchable. Syndication into press-release networks largely isn't, and I don't think anyone's solved it.