OpenAI's Aura safety check can block ChatGPT agents from your site with no trace in your logs

OpenAI runs a site-safety check, called Aura in its own systems, that decides whether ChatGPT and Codex browsing tools may open a domain at all. Search Engine Journal has documented a case where a well-known media publisher was blocked by it, even though its robots.txt was fully open and nothing on its side was wrong.

What the block does

• Agents query chatgpt.com/backend-api/aura/site_status before opening a link. A blocked result is cached locally for 24 hours.

• If the check hits a network glitch, the default is to allow access. Explicit blocks stay strict.

• The block overrides robots.txt, local user settings and custom allow rules set by company administrators.

• There is no public way to learn why a domain was flagged or to request a review.

What the case showed

Since May 2026, ChatGPT has repeatedly failed to load the publisher's pages. Its server logs show that no request from ChatGPT ever arrived. Codex Browser Use returned "The site-safety policy blocks this action" and told the model not to try alternatives. Two competitor publishers loaded in the same session, and so did a page running the brand's technology on another hostname. Weeks later, all five tested URLs were still blocked. OpenAI support confirmed in writing that a safety block was active and escalated the ticket to check whether it was intended.

Over the last 30 days the publisher's analytics counted ~5,000 successful connections to OpenAI's training crawlers, against 477,000 for Google and 564,000 for Anthropic.

What puts a domain on the list is unknown. Some researchers suspect the chat details sent with each status request. Search Engine Journal does not confirm that.

Why it matters for visibility

A standard audit reads your robots.txt, your firewall and your logs. This block sits upstream of all three, so a site can pass every audit and still be absent from ChatGPT's browsing answers. The signature is an absence: a failed fetch at a timestamp where your logs show nothing.

What to do

• Ask ChatGPT to open your key URLs, and test Codex Browser Use, in the same session as two or three competitor URLs.

• Check CDN and server logs at the failure timestamp. A block on your side leaves a 403 or a challenge page. An OpenAI-side block leaves no request.

• Rule out your own stack first, including Cloudflare's AI bot settings.

• If the block is OpenAI's, build an evidence pack and open a support case with three questions: whether the domain is classified, which surfaces it affects, and how to request a review.

• Avoid workarounds. OpenAI's usage policies prohibit bypassing safety mitigations.

• Retest on a schedule so you know when the block clears, and whether it returns.