Google-Safety user agent
Operated by Google
Google-Safety is Google's crawler for abuse-specific checks, such as malware discovery on publicly posted links.
The Google-Safety bot at a glance
- Google-Safety is operated by Google and fetches pages to power a specific product feature.
- The robots.txt token for Google-Safety is Google-Safety.
- Blocking a platform fetcher has no effect on organic search rankings.
- Google-Safety robots.txt support: No.
- Recommendation for Generative Engine Optimization (GEO): Allow.
What is Google-Safety?
Google-Safety scans links for safety problems across Google products.
Google states that Google-Safety ignores robots.txt rules.
Should you block Google-Safety?
Allow Google-Safety unless it causes a measurable load problem.
| Effect on search rankings | Blocking a platform fetcher has no effect on organic search rankings. |
|---|---|
| Effect on AI visibility | Blocking breaks the feature the fetcher serves, such as ad approval or feed updates. |
| Follows robots.txt | No |
| Recommendation | Allow |
How to block or allow Google-Safety
Put the robots.txt rule in the file at the root of every domain and subdomain, for example https://example.com/robots.txt. The token Google-Safety is matched case-insensitively. robots.txt alone may not stop Google-Safety, so add the Nginx, Apache or Cloudflare rule as well.
robots.txt: block
# Block Google-Safety
User-agent: Google-Safety
Disallow: /robots.txt: allow
# Allow Google-Safety
User-agent: Google-Safety
Allow: /robots.txt: partial
# Keep Google-Safety out of private areas only
User-agent: Google-Safety
Disallow: /wp-admin/
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/
Allow: /Nginx
# Nginx: return 403 to Google-Safety
if ($http_user_agent ~* "(Google\-Safety)") {
return 403;
}Apache
# Apache .htaccess: return 403 to Google-Safety
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (Google\-Safety) [NC]
RewriteRule .* - [F,L]Cloudflare WAF
# Cloudflare > Security > WAF > Custom rule, action: Block
(http.user_agent contains "Google-Safety")How to verify real Google-Safety traffic
Google publishes the IP ranges that Google-Safety uses. A request with the Google-Safety user agent from an IP outside that list is an impersonator.
Official Google-Safety IP list (JSON)
Reverse DNS check: look up the request IP, confirm the hostname ends in google.com, then look up that hostname and confirm it returns the same IP.
# 1. Reverse lookup: the hostname must end in google.com
host REQUEST_IP
# 2. Forward lookup: must return the same REQUEST_IP
host HOSTNAME_FROM_STEP_1How to find Google-Safety in your server logs
Search the web server access log for the token. The command below counts Google-Safety requests per URL on Nginx or Apache.
grep -i "Google-Safety" access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20For a full report per AI bot, upload the log to the AI Log File Analyzer, a free tool by Justin Hà.
Google-Safety FAQ
Google-Safety uses the robots.txt token "Google-Safety". Google does not publish a full user-agent string, so match the token inside the User-Agent header.
No reliable evidence says it does. Reports show Google-Safety crawling sites that disallow it, so pair robots.txt with a firewall or server rule.
Blocking a platform fetcher has no effect on organic search rankings. Blocking breaks the feature the fetcher serves, such as ad approval or feed updates.
Add two lines to the robots.txt file at the root of each domain and subdomain: "User-agent: Google-Safety" followed by "Disallow: /". The token is case-insensitive. Changes can take up to 24 hours to be picked up.
Yes. Google publishes the IP ranges Google-Safety uses. Check the request IP against that list; a matching user agent from any other IP is an impersonator.
Search your server access log for "Google-Safety", for example with: grep -i "Google-Safety" access.log. The AI Log File Analyzer by Justin Hà counts visits per AI bot from an uploaded log file.
Sources: Google crawler documentation. Last reviewed by Justin Hà.
See which of these bots actually reach your website
The AI Log File Analyzer by Justin Hà counts visits from GPTBot, ClaudeBot, PerplexityBot and other AI crawlers in your server log, for free. The GEO Technical Package sets up robots.txt, llms.txt and crawler access for AI search.
