I built a small robots.txt checker for my own sites, and last night I got curious and pointed it at 122 sites I actually use, the big ones everyone knows. It reads the file the way a crawler does (longest matching user-agent group wins, otherwise the wildcard) and tells me which of 19 AI bots are blocked.
The thing that surprised me most: six news sites block ClaudeBot and let GPTBot through. Washington Post, Guardian, Verge, WSJ, Wired, Ars Technica. Only one site anywhere did it the other way round, and it was Khan Academy of all places. I assume that's licensing deals showing up in a text file, but I don't actually know.
Most of the dev tool companies don't block anything. Cloudflare, Supabase, Netlify, Vercel, the React and Vue docs, even Anthropic's own site. The social networks and the newspapers block nearly everything, and so do Amazon and Yelp.
Bytespider is the most blocked bot on the list, ahead of GPTBot and ClaudeBot, which I didn't expect.
llms.txt is a developer thing so far. About 47 of the sites have a real one (I had to check the body, because a bunch of sites return their 404 page with a 200), and nearly all of those are companies that sell to developers. None of the newspapers I checked have one at all.
Usual caveat: robots.txt is a polite request and the server logs are what actually happened. I put the per-site results up as a json file if anyone wants to check a site they manage, allthepossibles.com/data/ai-crawlers-2026-10-19.json. The checker's mine, so take my framing with a grain of salt; the file is just what it saw.