ChatGPT Atlas Website Checklist: Crawlers, ARIA, and Referrals

ChatGPT Atlas brings search, page understanding, and user-directed browser actions into one browser experience. That does not turn every website decision into one new kind of "Atlas SEO."

A public page may be eligible for ChatGPT search through OAI-SearchBot. The same publisher may independently block GPTBot from potential model training. A user can ask ChatGPT to visit a page through a user-initiated path. An Atlas agent can also try to understand and operate an interface with the help of page semantics and ARIA. Those are related surfaces, but they are not interchangeable.

Short answer: Audit ChatGPT Atlas readiness as four contracts: search access, training choice, user-requested access, and browser-agent compatibility. Use OAI-SearchBot for search policy, GPTBot for the training choice, authentication and noindex for publication decisions, and semantic HTML plus accurate ARIA for interaction. Validate each layer with logs, rendered pages, a controlled Atlas task, and referral analytics. None guarantees display, citation, recommendation, ranking, or successful operation.

Start With Four Separate Control Planes

OpenAI's crawler documentation says its crawler settings are independent. A site can allow the search crawler while disallowing the training crawler. It also distinguishes automated crawling from certain requests initiated by ChatGPT users.

Use that separation before editing robots.txt.

The llms.txt and AI crawlers guide maps the same separation across OpenAI, Perplexity, Anthropic, and Google. Use this Atlas checklist when the OpenAI-specific browser and user-action layer needs a deeper test.

1. Set OAI-SearchBot Policy For Public Search Eligibility

OpenAI documents OAI-SearchBot as the crawler for ChatGPT search features. Its guidance recommends allowing the crawler and requests from its published IP ranges when a site wants eligibility.

Treat that as an access requirement, not a placement promise.

Inventory the pages that should act as public sources:

• Homepage and product explanation.
• Public use-case and comparison pages.
• Pricing, support, trust, and policy pages.
• Documentation intended for unauthenticated readers.
• Evidence-led articles, research, and methodology pages.

For each page, verify a final 200 response, a self-consistent canonical URL, crawlable body text, stable internal links, and no unintended noindex. The canonical URL checklist provides a source-by-source review of redirects, sitemap entries, canonicals, internal links, and public resource maps.

OpenAI notes that its systems may take about 24 hours to adjust after a robots.txt change. That is a policy-processing estimate, not a crawl, index, or appearance service-level agreement. Record the deployed version and time, then check later logs.

Allowing OAI-SearchBot cannot compensate for a thin, inaccurate, inaccessible, or poorly linked page. Use the internal-link audit for AI search crawlers to confirm that important source pages can be discovered through descriptive links from relevant public hubs.

2. Make The GPTBot Training Choice Separately

OpenAI describes GPTBot as a crawler for content that may be used to make its generative AI foundation models more useful and safe. Disallowing GPTBot indicates that site content should not be used for training those models.

That is a data-use decision. It is not a ChatGPT search opt-out.

A publisher can therefore choose this posture:

OpenAI's Atlas announcement says that, even when a user opts to include browsing content in training, webpages that opt out of GPTBot will not be trained on. Keep a dated record of the policy reviewed by legal or governance owners.

Do not describe a GPTBot opt-out as hiding the page from ChatGPT users. Do not describe an OAI-SearchBot allow rule as permission for training. Combining those statements into one "AI allowed" flag destroys the actual policy decision.

3. Treat ChatGPT-User As A User-Requested Path

OpenAI says ChatGPT-User is used for certain actions initiated by users in ChatGPT and Custom GPTs. It is not used for automatic web crawling, and it does not determine whether a page may appear in ChatGPT search. Because requests are user initiated, OpenAI also says robots.txt rules may not apply.

First, do not use a ChatGPT-User rule as a substitute for the OAI-SearchBot search policy.

Second, do not use robots.txt as a security boundary. Private account data, billing pages, reports, admin tools, and authenticated workflows require real authorization. A disallow rule is a crawler request, not an access-control system.

Third, do not assume every Atlas page load or agent action will appear in logs as ChatGPT-User. Atlas is a browser product, and browser traffic may look like ordinary browser traffic. Preserve actual request headers and application events from a controlled test instead of assigning an identity from the product name alone.

For monitoring strategy, the ChatGPT brand mention guide keeps crawler access, answer text, citations, competitors, and brand framing in separate evidence fields.

4. Use noindex For Publication Policy, Not Authentication

The OpenAI Publishers and Developers FAQ explains an important edge case. If OpenAI learns about a disallowed URL through another provider or another page and considers it relevant, Atlas may still show only the link and page title. OpenAI points publishers who do not want that outcome to the noindex meta tag and notes that a crawler must be able to fetch the page to read the tag.

This creates a clear control hierarchy:

• Use authentication and authorization to protect private data and private actions.
• Use noindex when a reachable page should not appear in search results.
• Allow the relevant crawler to fetch a public noindex page when it must read that directive.
• Use robots.txt to manage automated crawler paths, not to conceal secrets.
• Use canonicals for duplicate or preferred URL decisions, not for access control.

OpenAI's FAQ specifically points publishers to a noindex meta tag. Audit any X-Robots-Tag response headers because they can affect other search systems, but do not assume OpenAI treats that HTTP header as equivalent unless current official documentation confirms it. A staging environment, generated PDF, or export endpoint may set a header even when the HTML source contains no robots meta tag. Record the two controls separately and follow every redirect because a directive on an intermediate response does not necessarily describe the final page.

Keep the states explicit in the audit: public_indexable, public_noindex, authenticated, forbidden, and not_found. Collapsing them into "blocked" makes it impossible to tell whether the product, search policy, or deployment is behaving correctly.

5. Use ARIA To Improve Agent Compatibility

OpenAI says ChatGPT Atlas uses ARIA tags to help its agent interpret page structure and interactive elements. The Atlas launch page specifically tells website owners that ARIA can improve how the ChatGPT agent works with their sites.

That is a browser compatibility and accessibility claim. OpenAI does not say ARIA is a ranking factor, citation factor, or guarantee that an agent will complete a task.

Start with native HTML before adding ARIA. A real button usually exposes its role more reliably than a clickable div patched with several attributes. A real link communicates navigation. A connected label explains a form field. Headings, tables, lists, landmarks, and visible error messages give both people and tools a clearer page contract.

Use ARIA when native semantics do not express the component, and follow the WAI-ARIA Authoring Practices Guide for names, roles, states, keyboard behavior, and composite widgets.

Audit these Atlas-relevant interaction details:

• Every control has an accurate accessible name.
• Expanded, selected, checked, invalid, busy, and disabled states update correctly.
• Dialogs expose a label and manage focus predictably.
• Form errors identify the field and the recovery action.
• Loading states become a visible success or failure state.
• Pricing, shipping, plan limits, and destructive actions are not hidden behind hover alone.
• The DOM order, visual order, and keyboard order tell the same story.
• CAPTCHA, passkeys, payment confirmation, and other sensitive steps pause for the user rather than pretending an agent can bypass them.

The broader agent-friendly website checklist covers semantic controls, stable layouts, forms, visible feedback, and private product surfaces. The objective is a reliable interface for users and assistive technology first, with agent compatibility as an additional testable benefit.

6. Build A Public And Private Page Matrix

Run the policy review by page class, not only by user agent.

Do not make a private interface crawlable merely to be "agent friendly." The browser agent should receive only the authorizing user's permissions.

7. Validate Referral Tracking Without Inventing Influence

OpenAI's publisher FAQ says ChatGPT referral URLs include utm_source=chatgpt.com. This is a detectable post-click signal when the parameter survives.

Validate the complete path:

1. Start from an actual ChatGPT link or a controlled URL carrying the documented parameter.
2. Follow every redirect to the final canonical landing page.
3. Confirm that query cleanup, middleware, consent tools, and client-side navigation preserve the source information as intended.
4. Check analytics Realtime or DebugView for the landing page and source.
5. Verify the processed session later in the maintained AI-assistant or source view.
6. Complete a safe test conversion and confirm that its attribution rule is documented.

The GA4 AI referral traffic guide explains the default AI Assistants channel, provider and landing-page breakdowns, custom channel rules, and reasons some visits become Direct.

Do not turn referral count into an Atlas visibility score. A referral proves a detectable click. It misses unlinked mentions, unclicked citations, actions without a page transition, and visits whose source was lost.

Use the cited-but-not-mentioned funnel to keep crawl, retrieval, citation, answer absorption, brand mention, recommendation, and click as separate observable stages.

8. Run A Crawl, Log, And Browser Test Matrix

One successful page load is not an Atlas readiness test. Use several evidence lanes.

Keep crawler identity verification and synthetic user-agent testing separate. Anyone can send an OAI-SearchBot label. Validate the source IP against OpenAI's current published ranges before calling a request verified.

For a broader technical preflight, use the AI search visibility audit checklist. If a citation appears but may not support the answer's claim, continue with the AI citation accuracy audit.

9. Test Real Atlas Tasks Safely

Browser-agent QA should use a named user job, a controlled account, and a stopping rule.

Useful public tests include:

• Find the pricing page and explain the visible plan differences.
• Find the support path without submitting a form.
• Summarize a product or use-case page and list the evidence it cites.
• Identify whether a page is public documentation or a private app route.
• Start signup, then stop before creating a real account unless that action is authorized.

For authenticated tests, create a QA account with minimal data and permissions. Keep payment, deletion, publishing, permission changes, and other consequential actions behind explicit human confirmation. Record where the agent pauses, misreads a control, loses state, or cannot verify success.

Repeat tasks after layout, localization, consent, authentication, and viewport changes. OpenAI describes agent mode as an evolving preview that can make mistakes on complex workflows, so treat completion as a versioned result rather than permanent compatibility.

If the browser task exposes inaccurate brand information, use the AI answer correction workflow to preserve the error, trace the source, update authoritative pages, and run matched follow-up checks.

10. Report Outcomes With Denominators And Boundaries

Report what was tested and what remains unknown:

• Page cohort and canonical URLs.
• Live policy version and test time.
• OpenAI user agent or browser context tested.
• Public, noindex, authenticated, or forbidden state.
• HTTP and rendered-content result.
• Verified or unverified crawler identity.
• Browser task completion count and total attempts.
• Failure stage and recovery path.
• Detectable referral sessions and landing pages.
• Answer-level mentions, citations, and competitors in separate fields.

Avoid a single opaque "Atlas optimized" score. A site can pass crawler access and fail an authenticated form. It can support an agent workflow and still have no search citations. It can receive referrals even when the monitored brand Question did not produce a mention.

The ChatGPT brand monitoring use case shows how AEO Table organizes repeatable Questions and preserved answer evidence. AEO Table does not verify OpenAI crawler identity, control Atlas, guarantee citations, or replace accessibility, application security, browser QA, or analytics tools.

Common Mistakes

Do not use one allow or disallow rule for every OpenAI user agent without understanding the separate purposes.

Do not claim that blocking GPTBot removes a page from ChatGPT search.

Do not use ChatGPT-User as the search eligibility control.

Do not treat robots.txt as authentication or a confidentiality boundary.

Do not block a crawler from a public page and expect it to read that page's noindex directive.

Do not add inaccurate ARIA to make a component look "AI ready." Incorrect names, roles, or states harm accessibility and can make the interface harder to interpret.

Do not call ARIA a ranking or citation factor. The current OpenAI claim is about helping the Atlas agent understand and interact with websites.

Do not call a synthetic user-agent request a verified OpenAI crawl without checking the source identity.

Do not call a successful crawl a citation, a citation a referral, or a referral a conversion.

Do not claim that one successful Atlas workflow guarantees future completion. Record the product state, task, account, and date.

The Bottom Line

ChatGPT Atlas website readiness is a set of explicit contracts, not a new meta tag.

Use OAI-SearchBot for ChatGPT search access policy. Make the GPTBot training decision separately. Treat ChatGPT-User as a user-initiated path that is not the control for search. Use noindex for reachable pages that should not appear in search, and use real authentication for private data and actions. Build interfaces with native semantics and accurate ARIA because that supports people, accessibility technology, and browser-agent interpretation—not because it guarantees ranking or citation.

Then verify the live system: policy files, final URLs, rendered content, source IPs, server logs, controlled Atlas tasks, referral analytics, and matched answer evidence. Preserve each result with its denominator and limitation.

Create a free AEO Table account to monitor stable ChatGPT buyer Questions and preserve answer, citation, brand, and competitor evidence alongside your crawler, browser, and analytics checks.