Your Church's Website Might Be Blocking AI. Mine Was.

It’s funny. I spent last night building a dashboard to answer a question I was pretty sure I already knew the answer to: is AI actually reading my website?

I had done the homework. Structured data on every page. Clean sitemap. An llms.txt file sitting at the root, which is the new thing you publish so AI systems can make sense of your site. I had written posts about how people find churches through AI search now. I felt good about it.

So I wired up a little tracker at the edge of the site to log every AI crawler that showed up. Then I ran the obvious test. I pretended to be GPTBot, OpenAI’s crawler, and asked my own website for its homepage.

403 Forbidden.

I tried ClaudeBot. 403. PerplexityBot. 403. OAI-SearchBot, which is the one that powers the live citations inside ChatGPT… 403.

Every single one. Turned away at the door before my website ever knew anybody knocked.

The culprit wasn’t my site. It was Cloudflare, the service sitting in front of my site… and in front of a whole lot of church websites, including probably yours. Somewhere in the settings there was a switch labeled “Block AI bots,” and it was on. I never turned it on. It came that way.

Why an AI crawler block isn’t a technical footnote

Here’s a reality: the questions people are least likely to ask a human being are exactly the questions they now type into a chat box.

Why do I feel so empty. Does God actually forgive that. Is any of this real.

Nobody walks up to your welcome desk with those. But they’ll ask an AI at 11pm, because an AI doesn’t know them, doesn’t attend their mom’s church, and won’t bring it up at Thanksgiving. And whatever that AI says back… that’s the answer they carry into the next week of their life.

Church, we’ve spent a decade learning that our buildings are a lid and the mission field moved online. Fine. We learned it. But the front door of the digital mission field just moved again, and it moved fast. It used to be a search results page with ten blue links, and you had a shot at one of them. Now it’s an answer. One answer. Assembled from whatever sources the machine was able to read.

If it can’t read you, you are not in the answer. Not ranked low. Not on page two.

Absent.

The part that stung

Once I got the block turned off, I watched my tracker for about an hour. Eight different AI crawlers came through. GPTBot. ClaudeBot. Claude-SearchBot. PerplexityBot. Google’s AI crawler. Others.

Eight. In an hour. On a site that had been live for two days.

They had been coming the whole time. They were knocking, getting a door slammed in their face, and leaving. I had spent weeks making a website worth reading and had unknowingly hung a “no visitors” sign on the front of it.

I would love to tell you I caught this because I’m sharp. I caught it because I got curious at 10pm and ran a test I almost didn’t run. That’s the whole story. Somebody reading this has the same switch flipped on right now and no reason to suspect it.

Why the default is backwards for churches

I want to be fair to Cloudflare, because the setting isn’t malicious and it isn’t stupid. It’s built for a real problem.

AI companies have been vacuuming up publishers’ work to train models that then answer questions the publisher used to get paid for. If you’re a newspaper, if you sell courses, if your words are your inventory, blocking those crawlers is a completely rational act of self-defense. Cloudflare turned that defense on by default, and for a lot of the internet that’s a gift.

Now hear me say this next part carefully.

Your church is not in that business. We do not monetize the gospel. We have never once tried to keep the message behind a wall. Our entire problem, for two thousand years, has been getting it out, into languages and rooms and formats that didn’t want it yet.

Paul stood up in the middle of the Areopagus and preached off of somebody else’s altar inscription, in somebody else’s forum, in somebody else’s format. Nobody in Acts 17 is worried about content licensing.

So a setting that protects your inventory from being read is, for a church, protecting nothing and costing everything. The calculus that’s right for the Wall Street Journal is exactly upside down for a congregation that would happily hand its sermons to anyone who’d carry them.

The trap inside the trap: robots.txt won’t save you

This is the part I most want you to catch, because it fooled me for a while.

You may have a robots.txt file that explicitly welcomes AI crawlers. Mine did. Sitting right there, permission granted, plain as day.

It did not matter even slightly.

Robots.txt is a note on the door. The edge block is a bouncer on the sidewalk. The crawler never gets close enough to the building to read your note. You can be perfectly configured on every layer you know how to check and still be invisible, which is a genuinely lousy combination… you get the confidence of having done it right and none of the results.

The only test that means anything is asking your website for a page as an AI crawler and seeing what it says back.

How to check if your church website is blocking AI — four minutes

If your site sits behind Cloudflare, log in, choose your domain, and look in two places:

1. Security → Bots. Find the card about blocking AI bots or AI scrapers and crawlers. Set it to off / do not block. (Cloudflare has been retiring this older switch, so what you see may already have moved — if the card isn’t there, go straight to step 2.)
2. AI Crawl Control in the sidebar, sometimes called AI Audit. This is the newer per-crawler list, with an Allow or Block toggle on each bot by name. Allow them. All of them, unless you have a specific reason not to.

Two things worth knowing while you’re in there. These are separate controls and the coarse switch can override your per-bot choices, so check both or you’ll think you fixed it when you didn’t. And leave Bot Fight Mode alone… that one’s aimed at malicious bots and it should stay however your team set it.

Not on Cloudflare? You may still be blocked by your host, your firewall, or a security plugin. Ask whoever manages your site one question: “Can GPTBot and PerplexityBot fetch our homepage, or do they get a 403?” If they don’t know, that’s your answer, and it’s worth an hour of somebody’s time to find out.

Should you allow every AI crawler?

Fair question. Let me answer it straight instead of pretending it’s obvious.

There are crawlers that exist purely to harvest training data, and there are crawlers that fetch a page live because a real person just asked a real question about you. The second kind are the ones you cannot afford to lose. Claude-User, ChatGPT-User, OAI-SearchBot… those fire when somebody is actively asking. Blocking those is blocking a person mid-question.

The training crawlers are a values call, and I’ll tell you where I land: I want the machine that answers a spiritual question at midnight to have read the church’s answer and not only the internet’s. That doesn’t happen if we all opt out on principle while everybody else opts in.

And anything genuinely private… prayer requests, member directories, counseling forms… shouldn’t be sitting on a public URL where a crawler could reach it in the first place. That’s a separate conversation, and if it applies to you, have it this week.

Questions people are asking me about this

Is my church website blocking AI crawlers right now? You cannot know without testing it. Ask your site for a page while identifying as GPTBot and see whether you get a 200 or a 403. A green dashboard and a welcoming robots.txt both tell you nothing, because the block happens before either one is consulted.

Does robots.txt control AI crawlers? Only for crawlers that get far enough to read it. An edge-level block at your CDN or firewall rejects the request before robots.txt is ever fetched, so a permissive robots.txt sitting behind a block does exactly nothing.

Should churches block AI bots? Almost never. Blocking protects content you monetize, and churches do not monetize the gospel. The one thing worth protecting is genuinely private material, and that should not be on a public URL to begin with.

What is the difference between a training crawler and a live-answer crawler? Training crawlers gather data to build models. Live-answer crawlers — Claude-User, ChatGPT-User, OAI-SearchBot — fetch your page in the moment because a person just asked a question. Blocking the second kind means blocking someone mid-question.

Where is the setting in Cloudflare? Two places, and both matter: Security → Bots for the coarse “block AI bots” switch, and AI Crawl Control (sometimes AI Audit) for the per-crawler allow list. The coarse switch can override the per-bot choices, so check both.

One more thing

The scary version of this post is “AI is coming for the church.” That’s not what I saw last night.

What I saw was eight crawlers knocking on a door I’d accidentally locked, because somebody out there was going to ask a question, and the machine was going out looking for something true to say.

We keep asking how to reach people who will never walk into our buildings. Some of them are typing tonight. The only question on the table is whether the church left the door open.

Go check your switch. Then come tell us what you found… I’d genuinely like to know how widespread this is, and the fastest way to find out is a hundred of us checking at once and comparing notes.

If you want the deeper practitioner version of how search and AI answers actually surface a church, I wrote that up separately over at how people find churches in 2026.