Google-Site-Verification user agent
Operated by Google
Google-Site-Verification is the fetcher that checks Search Console verification tokens.
The Google-Site-Verification bot at a glance
- Google-Site-Verification is operated by Google and fetches pages to power a specific product feature.
- The robots.txt token for Google-Site-Verification is Google-Site-Verification.
- Blocking a platform fetcher has no effect on organic search rankings.
- Google-Site-Verification robots.txt support: Not for user-requested fetches.
- Recommendation for Generative Engine Optimization (GEO): Allow.
What is Google-Site-Verification?
Google-Site-Verification reads the verification file or meta tag when a site owner verifies a property in Search Console.
Blocking it can break Search Console verification.
Should you block Google-Site-Verification?
Allow Google-Site-Verification unless it causes a measurable load problem.
| Effect on search rankings | Blocking a platform fetcher has no effect on organic search rankings. |
|---|---|
| Effect on AI visibility | Blocking breaks the feature the fetcher serves, such as ad approval or feed updates. |
| Follows robots.txt | Not for user-requested fetches |
| Recommendation | Allow |
How to block or allow Google-Site-Verification
Put the robots.txt rule in the file at the root of every domain and subdomain, for example https://example.com/robots.txt. The token Google-Site-Verification is matched case-insensitively. robots.txt alone may not stop Google-Site-Verification, so add the Nginx, Apache or Cloudflare rule as well.
robots.txt: block
# Block Google-Site-Verification
User-agent: Google-Site-Verification
Disallow: /robots.txt: allow
# Allow Google-Site-Verification
User-agent: Google-Site-Verification
Allow: /robots.txt: partial
# Keep Google-Site-Verification out of private areas only
User-agent: Google-Site-Verification
Disallow: /wp-admin/
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/
Allow: /Nginx
# Nginx: return 403 to Google-Site-Verification
if ($http_user_agent ~* "(Google\-Site\-Verification)") {
return 403;
}Apache
# Apache .htaccess: return 403 to Google-Site-Verification
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (Google\-Site\-Verification) [NC]
RewriteRule .* - [F,L]Cloudflare WAF
# Cloudflare > Security > WAF > Custom rule, action: Block
(http.user_agent contains "Google-Site-Verification")How to verify real Google-Site-Verification traffic
Google publishes the IP ranges that Google-Site-Verification uses. A request with the Google-Site-Verification user agent from an IP outside that list is an impersonator.
Official Google-Site-Verification IP list (JSON)
Reverse DNS check: look up the request IP, confirm the hostname ends in google.com, googleusercontent.com, then look up that hostname and confirm it returns the same IP.
# 1. Reverse lookup: the hostname must end in google.com, googleusercontent.com
host REQUEST_IP
# 2. Forward lookup: must return the same REQUEST_IP
host HOSTNAME_FROM_STEP_1How to find Google-Site-Verification in your server logs
Search the web server access log for the token. The command below counts Google-Site-Verification requests per URL on Nginx or Apache.
grep -i "Google-Site-Verification" access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20For a full report per AI bot, upload the log to the AI Log File Analyzer, a free tool by Justin Hà.
Google-Site-Verification user agent string
The full user agent Google publishes for Google-Site-Verification. Version numbers such as Chrome/W.X.Y.Z change over time, so match the token, not the whole string.
Mozilla/5.0 (compatible; Google-Site-Verification/1.0)Google-Site-Verification FAQ
Google-Site-Verification identifies itself with the robots.txt token "Google-Site-Verification". A typical request header reads: Mozilla/5.0 (compatible; Google-Site-Verification/1.0)
Partly. Google-Site-Verification fetches pages because a user asked for them, and Google says robots.txt rules may not apply to those user-requested fetches. Use a firewall rule if you must stop it.
Blocking a platform fetcher has no effect on organic search rankings. Blocking breaks the feature the fetcher serves, such as ad approval or feed updates.
Add two lines to the robots.txt file at the root of each domain and subdomain: "User-agent: Google-Site-Verification" followed by "Disallow: /". The token is case-insensitive. Changes can take up to 24 hours to be picked up.
Yes. Google publishes the IP ranges Google-Site-Verification uses. Check the request IP against that list; a matching user agent from any other IP is an impersonator.
Search your server access log for "Google-Site-Verification", for example with: grep -i "Google-Site-Verification" access.log. The AI Log File Analyzer by Justin Hà counts visits per AI bot from an uploaded log file.
Sources: Google crawler documentation. Last reviewed by Justin Hà.
See which of these bots actually reach your website
The AI Log File Analyzer by Justin Hà counts visits from GPTBot, ClaudeBot, PerplexityBot and other AI crawlers in your server log, for free. The GEO Technical Package sets up robots.txt, llms.txt and crawler access for AI search.
