What is Google-Site-Verification? Google's on-request crawler
Google-Site-Verification fetches the verification tokens site owners place to prove ownership in Search Console.
30 of the 1662 major websites we measure block Google-Site-Verification in robots.txt (2%). 7 of those sites name it directly in their robots.txt; the rest are covered by a wildcard rule.
Key facts
| Fact | Detail |
|---|---|
| Operator | |
| Used for | Search Console site verification |
| Type | On-request fetcher. Fetches a page because a person or a site owner asked for it. Its operator says robots.txt may not apply. It isn't counted in the AI crawler figures. |
| robots.txt token | Google-Site-Verification |
| Operator's documentation | Read it here |
What blocking Google-Site-Verification does
Google says user-triggered fetchers generally ignore robots.txt rules, because a person asked for the fetch. The figures below show what files state, not what this fetcher does.
How to allow or block Google-Site-Verification
Add one of these groups to the robots.txt file at the root of your domain. It is a stated preference that well-behaved crawlers read, not an enforcement mechanism.
User-agent: Google-Site-Verification Disallow: /
User-agent: Google-Site-Verification Allow: /
Google-Site-Verification user agent string
Google's page doesn't list a full string, so look for Google-Site-Verification in the user agent field of your logs.
How to verify a request is really Google-Site-Verification
Anyone can put a crawler's name in a user agent string, so the name alone proves nothing. We did not find a published IP list or reverse DNS rule from Google.
How to whitelist Google-Site-Verification in a firewall or CDN
robots.txt only states a preference. A firewall, CDN or bot protection service can still refuse the request, and the crawler then gets an error even though robots.txt allows it.
- Check that no group in your robots.txt blocks it, using the rule above.
- Add an allow rule in your firewall or CDN that matches the name in the user agent. Keep the rule narrow, because anyone can copy a name.
- Check your server logs for a 200 response from Google-Site-Verification afterwards.
On Cloudflare, also check AI Crawler and Agent access policies, which can block search, agent and training traffic across a site.
Why Google-Site-Verification gets a 403 or 405 error
A 403 means the server refused the request, which usually points to a firewall or bot rule. A 405 means the server refused the request's method, so check any rule that only permits certain methods. A crawler that obeys robots.txt won't request a page it is told to avoid, so an error in your logs points to your server's configuration. To stop it deliberately at the server, this nginx rule returns a 403:
if ($http_user_agent ~* "Google-Site-Verification") {
return 403;
}Who blocks Google-Site-Verification, by sector
| Sector | Sites measured | Blocking | Share |
|---|---|---|---|
| Social and media platforms | 115 | 8 | 7% |
| Reference and research | 114 | 4 | 4% |
| Finance and business media | 94 | 3 | 3% |
| News publishers | 182 | 5 | 3% |
| AI companies | 128 | 3 | 2% |
| Technology media | 126 | 3 | 2% |
| E-commerce and retail | 92 | 1 | 1% |
| Government and institutions | 98 | 1 | 1% |
| SaaS platforms | 196 | 2 | 1% |
| Developer references | 159 | 0 | 0% |
| Health publishers | 88 | 0 | 0% |
| Hosting and infrastructure | 98 | 0 | 0% |
| SEO and marketing tools | 86 | 0 | 0% |
| Travel | 86 | 0 | 0% |
Sites blocking Google-Site-Verification
academia.edu, afterpay.com, barrons.com, consilium.europa.eu, devclass.com, disneyplus.com, distill.pub, eluniversal.com.mx, facebook.com, hackernoon.com, instacart.com, instagram.com, linguee.com, lobste.rs, magento.com, marketwatch.com, meta.ai, netflix.com, poe.com, reddit.com, sap.com, sciencedirect.com, theregister.com, thesun.co.uk, thetimes.co.uk, threads.net, todayonline.com, wordreference.com, wsj.com, x.com.
Sites that allow Google-Site-Verification by name
flickr.com, fortinet.com, imdb.com, news.com.au, pinterest.com, reuters.com, zeit.de.
Other Google crawlers
Google-Extended (Gemini training control), GoogleOther (research and development fetch), Google-CloudVertexBot (Vertex AI on-demand fetch), Google-Agent (agents acting for users), Google-GeminiNotebook (user-added sources), Googlebot (search indexing), Googlebot-Image (image indexing), Googlebot-Video (video indexing), Googlebot-News (news indexing), Storebot-Google (shopping crawl), Google-InspectionTool (search testing tools), GoogleOther-Image (image fetch for research), GoogleOther-Video (video fetch for research), AdsBot-Google-Mobile (mobile ad quality), AdsBot-Google (ad quality), Mediapartners-Google (ad matching), APIs-Google (API push notifications), Google-CWS (Chrome Web Store checks), FeedFetcher-Google (feed retrieval), GoogleMessages (link preview), Google-Pinpoint (user-added documents), GoogleProducer (publisher feeds), Google-Read-Aloud (read aloud on request).
See all 36 AI crawlers, the rule change log or the full study. Being reachable is only the first step: how AI search engines choose what to cite covers the rest.
Cite this data
You are welcome to quote or republish these figures. Please credit IndexHalo with a link to this page (CC BY 4.0). All our datasets are on the data page.
IndexHalo. "Google-Site-Verification block rate across major websites." Measured 12 November 2026. https://www.indexhalo.com/ai-crawlers/google-site-verification/
<a href="https://www.indexhalo.com/ai-crawlers/google-site-verification/">Google-Site-Verification block rate across major websites, IndexHalo</a>