This is a repost. Originally published on the Arvio blog: https://arvio.a.xyz/blog/shopify-gptbot. The canonical URL points back there.
Published September 3, 2026 by Adot Technologies Inc, the team behind Arvio: AI Store Operator. The counts below come from reading robots.txt on 58 live Shopify storefronts on September 3, 2026, plus a user-agent test run on our own domain.
Search "GPTBot" and page 1 is OpenAI explaining its own crawler, plus a row of bot-detection vendors explaining why you should buy bot detection. All of it is about GPTBot in general. None of it answers the question a Shopify merchant is actually holding: what is my store telling it right now, and did I choose that?
That question has a checkable answer, and it is public. We read it on 58 live Shopify stores.
Key takeaways Shopify ships every store a robots.txt you did not write. It is 116 lines, and it names exactly two user agents: and adsbot-google. GPTBot is not one of them. 53 of the 58 stores we could read were serving a file that matches its shape exactly. One store in 58 names GPTBot at all, and that one allows it. Zero of the 58 disallow GPTBot at the site root. Whatever the debate about AI crawling looks like online, it has not reached these stores' robots.txt files. A robots.txt asks; nothing enforces it. We could only test that on a server we are allowed to test — ours, which blocks nobody. A request carrying a GPTBot user agent and one carrying a normal browser user agent came back identical across all 36 URLs in our sitemap: same status, same byte count, same visible character count. That is one server, and it shows a server that does not discriminate — not that no server does. "Blocking GPTBot" is not "keeping my store out of ChatGPT." OpenAI runs separate agents for training, for search, and for user-triggered fetches, and its documentation is explicit that the robots.txt settings are independent of each other. Disallowing the training crawler does not remove you from ChatGPT's search answers; disallowing the search crawler does. Whichever way you want it, the fix is one template file in your theme, and you can verify it from a browser in one request. The syntax is the easy part. What takes thought is which of the three agents you actually meant.
Your robots.txt is a decision your store already made for you Arvio audits what your storefront publishes about your products: catalogue fields, product metadata, page descriptions. It shows you what is there before you change anything — the robots.txt above is a theme file, and that one is yours to edit. Install Arvio on the Shopify App Store →
Open https://yourstore.com/robots.txt in a browser tab. That is the whole diagnostic. It is a plain text file, it is public, and it is the file every well-behaved crawler reads before it reads anything else on your store.
You will almost certainly see a long list of Disallow: lines covering /cart, /checkout, /orders, /account, and a pile of /collections/sort_by variants. That is Shopify's default, and it is a sensible default — it keeps crawlers out of the pages that are per-visitor or infinite.
We fetched robots.txt from all 60 hostnames in a public sample of live Shopify storefronts. 58 answered.
53 of those 58 were serving a file with the platform default's exact shape. We tested the shape, not the bytes — we did not diff the whole file, so "same shape" is not the same claim as "never touched": swapping a Disallow path or adding a Sitemap line changes neither number we counted. What we can say is that on both counts the file was indistinguishable from the default: 109 non-blank lines (116 including blank lines) and exactly two User-agent groups — and adsbot-google. Every one of the 53 matched on both counts.
| Lines | What it looks like | |---|---| | 193 | Seven groups: the default's and adsbot-google, plus five named ones — Ahrefs (two), MJ12bot, Nutch, Pinterest | | 165 | Default plus eight named groups, including GPTBot. The only file in the sample that names it | | 159 | A different store, the same seven groups as the 193-line file, fewer rules inside | | 159 | A third store, the same seven groups again — but every group header is malformed. See below | | 20 | Far shorter than the default; not the same kind of edit as the other four |
Three days earlier, on August 31, we ran a narrower version of the same read against the same 60 hostnames: 59 answered, 54 were on the platform default, 5 were customised. The picture is stable. (That earlier file counted total lines including blanks, which is why its default is 116 and this one's is 109. Same file, two ways of counting — we re-fetched one default store to confirm both numbers describe it.)
Of all 58, exactly one has a User-agent: GPTBot group. That group carries no Disallow line at all, which means: crawl anything.
So the count that matters is the boring one. Stores in this sample that block GPTBot from the site root: 0 of 58.
That may not be what you expected. We measured these 58 storefronts and nothing else — we have no reading on what publishers outside this sample are doing, and this survey cannot give you one. Inside it, the file is untouched on this question.
One store's robots.txt has every group header collapsed onto one line with the rule that should follow it:
All seven of its groups look like that — the same seven the other two customised stores have — including the group that carries the cart and checkout rules. Our parser, which requires the header to be its own line, finds no valid User-agent group in the file at all; we did not test it against Google's or OpenAI's parsers, so what any of them does with it is not something this survey measured. What the file does do is return 200 across 159 non-blank lines that look fine at a glance, which is the part worth knowing: nothing about it tells you it is broken.
A robots.txt does not report errors. Nothing turns red. Nobody emails you. If you edit yours, the only way to know it worked is to read it back and check the shape.