OpenAI's Aura Safety Check Can Silently Block Sites From ChatGPT

OpenAI runs a central safety system, called Aura, that can silently prevent ChatGPT and Codex from opening a website — overriding robots.txt permissions and local user settings. An investigation by Search Engine Journal contributor Taylor Dan RW details how the system works, why legitimate publishers get caught, and what site owners can do about it.

A case study sits at the center of the report: an international media publisher, running open robots.txt rules and even a paid 24-hour ad campaign with OpenAI, has been unable to load its own pages in ChatGPT since May 2026. Server logs show zero requests from ChatGPT ever reached the site. The block happened upstream, inside OpenAI's infrastructure.

What is Aura and how does it work?

Aura is a site-safety check separate from OpenAI's known crawlers. GPTBot (training), OAI-SearchBot (search) and ChatGPT-User (direct user requests) publish their IP addresses and follow standard web rules. Aura sits above them as a separate guard that decides whether autonomous browsing tools may visit a link at all.

Network traffic shows the check calls chatgpt.com/backend-api/aura/site_status. When a site is flagged, the decision is cached locally for 24 hours. OpenAI's help pages say agents can be blocked for "security, safety, and compliance reasons" via a global blocklist. The company does not explain how classifications are made.

Two technical details matter. First, explicit blocks fail closed: even if company administrators set custom allow rules, OpenAI's internal decision overrides them. Network glitches, by contrast, default to allowing access, per OpenAI engineers. Second, researchers suspect prompt histories may influence blocks, because requests to the status API send chat details alongside URLs.

What did the blocked publisher find?

Testing produced a concrete refusal message: "Browser Use rejected this action due to browser security policy. Reason: The site-safety policy blocks this action; no user permission prompt or Auto-review was attempted. Browser use is not permitted on [domain]."

The comparison tests ruled out any fault on the publisher's side:

• Two direct competitor news platforms loaded fine in the same session.
• A third-party newspaper page running the brand's own technology, on another domain, loaded fine.
• Chrome permissions set to "Always allow" for the brand changed nothing.
• Five tested URLs — main site, subdomains, article pages — remained blocked weeks later.

Crawl analytics added context. The site served roughly 5,000 successful connections to OpenAI's training crawlers in 30 days, versus 477,000 for Google and 564,000 for Anthropic. Agent browsing was blocked outright while crawlers barely visited.

OpenAI support escalated the case to specialist teams, writing: "…to determine whether [the domain] is subject to an OpenAI-side site-safety restriction and identify the appropriate next steps." A later email said: "…to review the block and determine whether it's expected." Staff confirmed in writing that a safety block was active, without naming Aura.

This contradicts OpenAI's public help pages, which typically blame browsing failures on the website's own security rules. The publisher's logs showed clean traffic and healthy crawler visits.

How can site owners detect a false block?

The report recommends a structured testing plan before contacting support:

• Test the same URLs across surfaces: ChatGPT live fetch, the cloud browser, Codex Browser Use and Computer Use.
• Run competitor controls in the same session to rule out an agent outage.
• Check CDN and server logs. An OpenAI-side block leaves no request in your logs; a site-side block leaves a 403, challenge page or WAF event.
• Compare crawler analytics: if GPTBot or ChatGPT-User gets 2xx responses while agents are refused, the problem is upstream.
• Test subdomains, deep URLs and third-party pages running your technology on another hostname.
• Record exact error wording, such as "The site-safety policy blocks this action" or "URL cannot be opened (non-retryable error)," with timestamps and time zones.
• Rule out your own stack: robots.txt, WAF and bot-management rules, Cloudflare AI bot settings, geo-blocking, rate limits.

What can affected owners do?

No self-service page exists to fix Aura classifications. The report advises building an evidence pack: error screenshots with timestamps, competitor controls, log extracts showing no inbound requests, crawler analytics and robots.txt. Owners should open support cases, keep case numbers, and ask three questions — whether the domain has a site-safety classification and why, which surfaces it affects, and how to request a review. Advertisers and enterprise partners should escalate through account contacts.

Workarounds are off the table. The tool tells agents not to circumvent the policy, and OpenAI's usage policies prohibit bypassing safety mitigations. Attempting it, the report warns, is the fastest way to turn a false positive into a justified block.

Why it matters commercially

A false Aura block removes a site's entire presence on OpenAI. Agents that cannot open a page simply move to a competitor — in the report's tests, rival news sites loaded in the same sessions where the publisher failed. ChatGPT then builds answers from secondary sources, forum posts and outdated articles, creating reputation risk for established brands.

The losses stay invisible. Blocks stop connections before requests leave OpenAI, so analytics record nothing. There are no status pages, appeal forms or fix-time estimates — and paying advertisers can fund ChatGPT placements while browsing agents remain blocked from their links.

The report's closing argument: blocking genuinely dangerous sites is sound protection against prompt injection and web fraud, but a system that can quietly block real companies needs management tools, clear errors and documented reviews, the way search engines built webmaster tools for manual penalties. Until then, brands must add agent access checks to their regular AI search audits — being crawlable is no longer enough.