> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rankraft.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Crawler verification

> How RankRaft AI tells a genuine AI crawler from one that only claims to be.

Anyone can send a request with `GPTBot` in its user agent. To tell genuine crawlers from impersonators, RankRaft AI checks the IP address of every crawler hit against the IP ranges the provider publishes.

## Verification states

| State | Shown as | Meaning |
| - | - | - |
| `verified` | **Verified** | The user agent matched a known crawler and the IP address is inside that provider's published ranges. |
| `failed` | **Spoofed** | The user agent matched a crawler whose provider publishes ranges, but the IP is **not** in them. This is almost always an impersonator. |
| `partial` | **Partial** | The user agent matched, but the provider publishes no IP ranges, so the match is on user agent only. |
| `unverified` | **Unverified** | The provider publishes ranges, but no IP address came with the hit, or the ranges had not loaded yet. |

Human visits and AI referrals don't have a verification state.

## Providers with published ranges

RankRaft AI refreshes these lists every day. If a provider's list can't be fetched, the previous day's list stays in use.

| Provider | Crawlers that can be verified |
| - | - |
| OpenAI | GPTBot, OAI-SearchBot, ChatGPT-User |
| Google | Googlebot, Googlebot-Image, GoogleOther, Google-Extended, Google-CloudVertexBot, Google-InspectionTool, AdsBot-Google |
| Microsoft | bingbot |
| Perplexity | PerplexityBot, Perplexity-User |

Every other provider, including Anthropic, Meta, Apple and Amazon, publishes no machine-readable IP ranges. Their crawlers are always **Partial**.

<Info>
  Anthropic publishes no IP ranges, so ClaudeBot, Claude-User and Claude-SearchBot will always show 0% in the **Verified** column. That is expected and doesn't mean the traffic is fake.
</Info>

## Reading the Verified column

The **AI bots on your site** table on the [Bots page](/agent-analytics/dashboard/bots) shows the percentage of each bot's hits that were verified. To see only impersonators, open the [Request log](/agent-analytics/dashboard/logs) and set **Verification** to **Spoofed**.

## Why genuine crawlers can show as Spoofed

Verification needs the visitor's real IP address. If your integration reports the IP of a proxy, load balancer or CDN instead, every crawler from a provider with published ranges will look spoofed.

* **Cloudflare Worker:** uses `CF-Connecting-IP`, so this doesn't happen.
* **WordPress behind Cloudflare:** handled automatically.
* **WordPress behind another CDN or load balancer:** add the proxy's addresses with the `rankraft_aa_trusted_proxies` filter. See [Security and privacy](/agent-analytics/wordpress/security-privacy#trusted-proxies).
* **Server logs:** send the client IP from `X-Forwarded-For` or your proxy's real-IP header in the `ip` field, not the proxy's address.

## Dropping spoofed traffic

Spoofed hits are stored by default so you can see who is impersonating AI crawlers. They are still counted in your daily totals either way.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.