Guide · Updated October 2026

Your Cloudflare Settings May Be Silently Failing Your ChatGPT Ads

OpenAI's ad crawler OAI-AdsBot has no published IP ranges, so Cloudflare's bot defenses can challenge or block it like any unknown bot. A blocked crawl usually means a failed review — and Cloudflare won't email you about it. Here's how to confirm and fix it.

Why Cloudflare blocks a crawler you want

Cloudflare protects millions of sites with layered bot management. Three features most often collide with ad crawlers:

• Bot Fight Mode (Security → Bots) — automatically challenges "definitely automated" traffic. Great against scrapers, blind to whether the bot is one you want.
• Security Level "High" or "I'm Under Attack" — issues JS challenges that non-browser crawlers cannot solve.
• Custom WAF rules / managed rulesets — broad "block all bots" or geo/ASN rules that accidentally match crawlers.

Because OpenAI publishes an IP list for GPTBot and OAI-SearchBot but not for OAI-AdsBot, IP-based allowlists don't help here. The reliable lever is the user-agent — verified by reverse-DNS on OpenAI's side.

Step 1 — Confirm it's actually happening

Two minutes in the Cloudflare dashboard:

1. Go to Security → Events and filter by user agent contains OAI-AdsBot.
2. Look for BLOCK or MANAGED_CHALLENGE actions on your landing page URL around the time you submitted the ad.

No events logged? The faster external check is a crawl simulation: AdBot Inspector fetches your page with the exact OAI-AdsBot user-agent and reports whether a WAF signature (Cloudflare included) intercepted it — no dashboard access required.

Step 2 — Write the allow rule

In Security → WAF → Custom rules → Create rule, add an exception that runs before your blocking rules:

(http.user_agent contains "OAI-AdsBot") or (http.user_agent contains "OAI-SearchBot")

Set the action to Skip (all remaining custom rules) — or at minimum Allow if your plan lacks Skip. If you use Zone Lockdown or IP access rules on the landing path, note they evaluate before custom rules; move the allowlist into the lockdown exception instead.

If Bot Fight Mode is on, be aware it sits outside custom rules on some plans — the practical combination most sites land on: Bot Fight Mode off, Super Bot Fight Mode (paid) with "verified bots allowed", plus the custom allow rule above.

Not on Cloudflare? Same story elsewhere

Step 3 — Verify the fix before resubmitting

Run the inspection again: the report should show the page reachable with the AdsBot user-agent (HTTP 200, no challenge markers). Then resubmit the ad. For the full picture of what the crawler checks beyond reachability, see our OAI-AdsBot complete guide and the 7 rejection reasons.