OpenAI 的 Aura 安全检查可能阻止网站被 ChatGPT 浏览

Most discussions about getting noticed in AI search still focus on gaining citations through structured content, clear entity definitions, and proper permissions inside robots.txt files. However, I have recently been looking into a much more basic problem that happens well before any of those standard steps, even though digital publishers almost never talk about it.

OpenAI uses a central safety check to decide whether its web-browsing tools are allowed to connect to any given website. If a site gets flagged by this system, referred to by OpenAI’s systems and codebase as Aura (not to be confused with Aura, which was a codename for Atlas), tools like Codex’s Browser Use and ChatGPT’s live search will refuse to open it at all, completely ignoring your local user settings and robots.txt rules.

While most websites never run into these restrictions, perfectly normal and well-established companies can suddenly find themselves added to this blocklist. Unfortunately, there is currently no public way to find out why a website was blocked or to ask for a proper review.

What This Block Is (And What It Isn’t)

To understand this issue properly, you first need to clear up a common misunderstanding about how web crawlers work. Knowing the difference between normal automated data collectors and live browsing tools is essential when you are trying to work out why an agent cannot load a page.

OpenAI publicly listed several different web crawlers, including GPTBot for training models, OAI-SearchBot for search features, and ChatGPT-User for direct requests made by users. Although these crawlers publish their IP addresses and follow standard web rules, they operate separately from the safety rules that control AI agents.

The site-safety check acts as a separate guard, deciding whether autonomous tools are allowed to visit a specific link. While OpenAI mentions that some browsing limits exist to stop agents from opening harmful content, they do not explain exactly how the system works under the hood.

Official help pages state that agents might be blocked from visiting certain sites for security, safety, and compliance reasons using a global blocklist. System documentation adds that browsing is blocked on sites linked to illegal activity, which is a sensible safety measure that makes sense for everyone.

What OpenAI does not explain publicly is the technical setup behind this system, which can be seen in network traffic making checks to chatgpt.com/backend-api/aura/site_status. When a website is flagged as blocked by this check, that decision is saved locally for 24 hours without giving the owner any clear way to appeal or ask questions.

Two other technical details are especially important when looking at how these blocks work in practice. Understanding these details helps explain why mistaken blocks can cause so much trouble for a website.

It Fails Closed In The Way That Matters

Although OpenAI engineers have said that network glitches during status checks default to allowing access, explicit site blocks remain completely strict. Even if company administrators set up custom allow rules inside their own systems, OpenAI’s internal decision overrides them and stops the page from loading.

We Don’t Know What Puts A Domain On The List

Because requests to the status API send chat details alongside web links, some researchers think that certain prompt histories might accidentally trigger site-wide blocks. Whatever the exact reason turns out to be, trusted business platforms, including well-known media brands, are facing unexplained blocks that stop agents from visiting them.

Receipts: The Household-Name Publisher That ChatGPT Can’t Open

I have been advising an international media publisher that distributes official news and magazine content while recently running a single, 24-hour ad campaign with OpenAI to evaluate the platform and establish an additional Support channel. Despite keeping completely open robots.txt rules and supporting OpenAI’s tools, the publisher ran into major, unexplained access problems across its main website.

Since May 2026, ChatGPT repeatedly failed to load the publisher’s web pages, returning general error messages without ever trying to connect. Detailed server logs showed that no traffic from ChatGPT ever reached the website, proving that the block was happening further up the line.

Tests carried out using the Codex CLI and desktop apps confirmed that Browser Use explicitly refused to visit the site. The security message specifically named site-safety rules as the only reason for stopping the request.

“Browser Use rejected this action due to browser security policy. Reason: The site-safety policy blocks this action; no user permission prompt or Auto-review was attempted. Browser use is not permitted on [domain].”

Furthermore, the agent system told the underlying model not to try any backup plans or alternative ways to load the page. This proved that the rule was being strictly enforced at the platform level.

A series of comparison tests proved that this connection failure was caused by a mistaken safety label rather than a mistake in the website’s setup. By carefully changing one variable at a time across different chats, we gathered clear proof that the website was being deliberately blocked.

In the same session, two direct competitor digital newspaper and magazine platforms loaded fine.
A third-party newspaper page powered by the brand’s own technology, but hosted on another domain, also loaded fine. Same tech, different hostname, no block.
Chrome permissions were set to “Always allow,” with an explicit entry for the brand. Still blocked.
Weeks later, all five tested URLs (main site, subdomains, article pages) were still blocked.

At the same time, website traffic stats showed only ~5,000 successful connections served to OpenAI’s training crawlers over the last 30 days. For a site of this size, that is barely anything when compared to other major AI crawlers like Google at 477,000 and Anthropic at 564,000, revealing that overall crawl access was actually minimal even though agent browsing was completely blocked.

The ongoing help messages with OpenAI’s technical support team have revealed some interesting details about the issue. Early checks by front-line support staff quickly led to the ticket being passed up to specialist internal teams.

“…to determine whether [the domain] is subject to an OpenAI-side site-safety restriction and identify the appropriate next steps.”

Later emails confirmed that specialist groups were actively checking whether the block on the domain was intentional. This ongoing internal review highlights the complete lack of clear, automated management options for affected website owners.

“…to review the block and determine whether it’s expected.”

Although support staff avoided directly naming the internal Aura system, they admitted in writing that a safety block was active. Their written responses confirmed that an internal check was required to see if the website restriction was supposed to be there.

This situation directly contradicts official public help pages, which usually blame browsing failures on the website’s own security rules. Because the publisher’s system maintained clean traffic records and healthy crawler visits, the block clearly came entirely from inside OpenAI’s infrastructure.

How To Tell If You’ve Been Falsely Blocked

If you suspect that your website is suffering from an accidental safety block, you should follow a step-by-step testing plan right away. Using a structured approach allows you to collect solid technical proof before you reach out to support.

Test the same URLs across surfaces. Try ChatGPT live fetch (ask it to open a specific URL), the ChatGPT cloud browser, and Codex Browser Use and Computer Use. A site-safety block tends to show up on more than one surface.
Run controls in the same session. Open two or three competitor sites straight away. If they load and you don’t, that rules out a general agent outage.
Check your CDN and server logs for a lack of requests. A site-side block leaves a footprint: a 403, a challenge page, a WAF event. An OpenAI-side block leaves no request in your logs at the timestamp of the failed attempt.
Check crawler analytics. If GPTBot, OAI-SearchBot, or ChatGPT-User are getting 2xx responses from you while agents are refused, the problem is upstream of your site.
Test the edges. Try subdomains, deep article URLs, and, if possible, a third-party page that runs your technology on another domain. A hostname-level classification will block the first two and allow the third.
Record the exact error wording. “The site-safety policy blocks this action,” “Browser use is not permitted on…,” “This session has been stopped because Computer Use is not allowed on the current browser URL,” “Not permitted,” and “URL cannot be opened (non-retryable error)” are all variants I’ve seen cited. Screenshot them and note timestamps with the time zone.
Rule out your own stack. Check robots.txt, WAF and bot-management rules (including Cloudflare’s AI bot settings), geo-blocking and rate limiting. Sometimes the block really is yours, so be certain before escalating.

If your testing across different tools confirms that requests are being turned down while your server logs show zero incoming hits from agents, an internal system block is almost certain. Once you have ruled out your own firewalls and blocklists, you can confidently blame the issue on a decision made inside OpenAI.

What You Can Do About It

Because there is no self-service page to fix Aura classifications, fixing a mistaken block requires thorough evidence and persistent follow-up. Website managers need to put together clear diagnostic packs to back up their support requests.

Build an evidence pack. Include screenshots of the errors with timestamps, the competitor controls, log extracts showing no inbound request, crawler analytics showing successful OpenAI crawls, and your robots.txt.
Open a support case and keep the case numbers. If more than one product is affected, say so in each case and ask explicitly for the cases to be linked. Don’t assume OpenAI will join them up.
Ask three specific questions. One, does the domain have a site-safety classification, and if so, why? Two, which surfaces does it affect: ChatGPT live fetch, search via OAI-SearchBot, the cloud browser or agent, and Codex? Three, what’s the process for requesting a review?
Use every relationship you have. Advertisers, publisher partners, and enterprise customers should raise it through account contacts as well as support.
Don’t attempt workarounds. The tool explicitly tells agents not to circumvent the policy, and OpenAI’s usage policies prohibit bypassing safety mitigations. Trying to sneak around a classification is the fastest way to turn a false positive into a justified one.
Monitor. Retest your key URLs on a schedule and log the results. You’ll want to know when it clears, and whether it comes back.

The Commercial Impact

When measuring how well a site performs in AI search, companies usually look at visibility, accurate information, and referral traffic. If you’re mistakenly blocked by the site-safety Aura, you’re effectively losing your entire presence on OpenAI, which can have substantial commercial ramifications.

As people move towards using autonomous agents that search the web and complete tasks directly, blocked sites are automatically left out of the choices. When an agent cannot open your website to grab live information or complete an action, it simply moves on to another source.

More often than not, this will be treated by organizations as a visibility problem, and resources will be thrown at it to solve the ChatGPT (lack of) visibility problem. When in reality, the hidden block means you can invest in the greatest GEO/AEO campaign of all time and see no results.

In our testing, competing news sites opened without any trouble in the exact same chat sessions. As a result, whenever an agent needs live web access to answer a question, accessible competitor brands win the traffic by default.

Without direct access to your main web pages, ChatGPT builds answers using secondary sources, forum posts, and outdated news articles. For established brands that rely on trust and accuracy, this creates serious risks for their public reputation.

Because Aura blocks stop connections before requests ever leave OpenAI, web server logs show no record of the failed visit. Unless your team specifically tests agent actions, major losses in potential user visits stay completely hidden from your analytics.

Affected site owners get no status pages, clear rules, formal appeal forms, or estimated fix times. Surprisingly, paying advertisers can find themselves paying to show up in ChatGPT even while its browsing agents are completely blocked from opening their links.

My Perspective

It makes complete sense for OpenAI to block access to genuinely dangerous websites to stop prompt injection attacks and web fraud. Setting up a strong security layer above individual user choices is a sensible protective step for AI tools that browse the web.

However, any system that can quietly block real commercial companies needs to offer proper management tools, including clear error messages and documented review processes. Just as search engines built webmaster tools to resolve manual penalties, AI search platforms must create clear management processes for site owners.

Until such management tools exist, those responsible for an organization’s search presence need to include agent access checks as part of their regular AI search audits. Making sure your website can be crawled is no longer enough; your site must also be able to be opened by autonomous agents.

More Resources:

Featured Image: Nerza/Shutterstock