--- title: "Anyone can pretend to be Googlebot. Here’s how to check who’s really visiting" description: "Google’s Gary Illyes says faking Googlebot takes about 30 seconds. What that means for small sites, how to check real Google visits, and what not to block." url: https://dumbcmo.com/blog/fake-googlebot-how-to-check category: "Getting found" tags: ["news", "seo", "security", "website", "wordpress"] published: 2026-11-01 updated: 2026-11-01 reading_time: 11 min author: "The DumbCMO" --- # Anyone can pretend to be Googlebot. Here’s how to check who’s really visiting > **TL;DR:** Any script can call itself Googlebot by changing one line, so never trust the name alone. Real Googlebot passes a two-way DNS check or matches Google’s IP lists. Most small sites don’t have a problem. If you do, use Cloudflare or your security plugin, never block Google by name. [Notebook](https://dumbcmo.com) › [Blog](https://dumbcmo.com/blog) › Getting found › Anyone can pretend to be Googlebot. Here’s how to check who’s really visiting Someone walks into your shop wearing a shirt that says “Inspector”. Do you hand over the keys to the store room? No. You ask for ID. Websites hand over the keys all the time. A visitor says “I’m Googlebot” and many sites just believe it. On a podcast released on 28 October 2026, Google’s Gary Illyes said how easy that lie is. In his words: “if I wanted to crawl as Googlebot, it would take me probably 30 seconds to set up a script”. He called it “literally one line of code”. Here’s what that means for your site, and the simple ways to check who’s really knocking. ## In normal-people words ## In normal words Every visitor to your site sends a little name tag along with each request. It’s called the user-agent (A short line of text a browser or bot sends with every request, saying what it is. The visitor writes it themselves.). Chrome says “I’m Chrome”. Google’s crawler says “I’m Googlebot”. The catch: **the visitor writes its own name tag.** Nobody checks it. A scraper can type “Googlebot” as easily as you type your name in a form. Illyes said it plainly: “The most prominent way and also the most spoofable way is the user agent header.” Asked how common faking it is, he said: “Unfortunately, very.” He said he knows because he set up “honey traps” on the internet to watch. So the name tag proves nothing. The real proof is **where the visit comes from**: Google’s own addresses on the internet. You can check that. Google tells you how. > **The DumbCMO:** A bot calling itself Googlebot is like a caller saying “Hello, I am from Google, your listing will be deleted”. Same bullsh#t, different door. ## Why a fake Googlebot is your problem Most fake Googlebots aren’t trying to rank you. They want something. - **Your content.** Scrapers copy pages, prices and product photos. Illyes: once a fake crawler has it, “you simply just don’t know what is going to happen with your content”. Google’s own spam policies list scraped content as spam, so copies of your work can turn up on junk sites. - **Your bandwidth and server.** “It’s super easy to overwhelm a site,” Illyes said. Worst case? “Bring it down.” Then “real visitors cannot go to your site”. On cheap shared hosting, that’s a slow site or a suspended account. - **Your locked doors.** Some sites let anything named Googlebot past a paywall, login or firewall. Google’s own Search Console help warns that “Googlebot can be spoofed, so allowing entry for Googlebot effectively removes the security of the page.” - **Your decisions.** If you read server logs and see “Googlebot” hammering a page, you might think Google loves it, or hates it. Some of those lines may be fakes. Don’t make SEO calls from user-agent names alone. One piece of good news: Google Analytics automatically leaves out traffic from known bots and spiders. Fakes mostly show up in your server logs and hosting stats, not your GA4 reports. **Three ways to tell who’s visiting** | Check | Can a scraper fake it? | Good for | | --- | --- | --- | | User-agent name says Googlebot | Yes, in seconds | Nothing. Never trust it alone | | Two-way DNS check | No, not without Google’s servers | Checking a handful of visits by hand | | Match against Google’s IP lists | No | Checking lots of visits, or setting up tools | ## First: do you even have a problem? This is the part the security salesmen skip. Illyes’ own advice: “first, try to see if you actually have a problem, because most sites don’t have a problem”. Signs you might: - Your site gets slow at odd hours, or your host warns you about resource use. - Your content keeps turning up copied on other sites. - Your logs show loads of “Googlebot” visits, but Search Console shows far fewer. That last one is the cleanest test. Search Console only shows what Google really did. **Compare against Search Console (5 minutes)** 1. **Open Crawl Stats.** In Search Console, go to Settings, then Crawl stats, then Open report. It shows Google’s real crawl requests, by response, file type and Googlebot type. 2. **Note the rough shape.** How many requests a day? Which pages? Any spike? 3. **Compare with your logs.** If your server logs show far more “Googlebot” than Search Console, the extra is likely fakes. Two honest notes. Google says this report is “aimed at advanced users”, and sites with fewer than 1,000 pages “should not need to use this report”. And it only works on a root-level property (your whole domain, not one folder). If your site is small and running fine, it’s OK to stop here. ## How to check one visit by hand Found a suspicious “Googlebot” visit in your logs? Copy its IP address. Google’s documentation gives four steps. On a Mac or Linux computer, open Terminal. (Windows has `nslookup`, which does the same job.) **Is this really Googlebot?** 1. **Ask who owns the address.** Run a reverse lookup: `host 66.249.66.1` (use the IP from your logs). Google’s example answer is `crawl-66-249-66-1.googlebot.com`. 2. **Check the ending.** The name must end in `googlebot.com`, `google.com` or `googleusercontent.com`. Anything else, it isn’t Google. 3. **Ask the name for its address.** Run a forward lookup on that name: `host crawl-66-249-66-1.googlebot.com`. 4. **Do they match?** You should get the same IP you started with. Same IP, real Google. Different or nothing, fake. Why both directions? A faker can make their own server *claim* a Google-sounding name. They can’t make Google’s name point back to their server. Google says this manual check is “sufficient for most use cases”. Checking thousands of lines? Google also publishes its crawler IP addresses as JSON files, updated regularly. The main one for Googlebot is `common-crawlers.json`. Tools and developers match against these instead of doing lookups one by one. The file I opened was created on 30 October 2026, so it’s live and current. ## The chai stall version Ramesh runs a spice shop website from Kochi. His host emails: “high CPU usage”. His logs are full of “Googlebot”. He picks five of the busiest IPs and runs `host` on each. Two come back as `googlebot.com` names and match both ways. Three come back as some hosting company in another country. **Two real Googles, three liars in a Google costume.** He blocks the liars, not the name. His Google crawling carries on as normal. ## The non-technical route You don’t need Terminal for any of this if you let a tool do it. Illyes again: for most site owners, “a free solution, like a CDN is the way to go”. He also said platforms like Shopify “have these protections implemented already”. Same goes for most hosted builders. If you’re on Shopify, you likely have nothing to do. **If your site is on Cloudflare (free plan works):** - Cloudflare keeps a list of verified bots. It checks them by their published IP lists, reverse DNS or a newer signing method. Googlebot is on that list. - Its managed rules include one called “Fake Google Bot”, which flags visits that claim to be Googlebot but don’t pass Google’s checks. - On any plan, you can make your own rule in Security, under WAF custom rules. Set: User Agent contains “Googlebot” AND Known Bots equals false. Action: Block. In Cloudflare’s rule language that’s `not cf.client.bot` for the second part. Real Googlebot is a known bot, so it passes. The costume doesn’t. - Bot Fight Mode is free and challenges bad bots. Cloudflare says verified bots have historically been left out of its default bot settings. Just know you can’t make exceptions to it with your own rules, so if something breaks, switch it off and test. **If your site is on WordPress without Cloudflare:** - Security plugins like Wordfence can rate-limit crawlers and have a setting for fake Google crawlers. In Wordfence, look under All Options, in the Rate Limiting section. Check your plugin’s own help pages for the exact wording on your version. - Not technical at all? Ask your host or developer one line: “Can you block requests that claim to be Googlebot but fail Google’s reverse DNS check?” Any decent one will know what you mean. **What NOT to do** - **If** You’re tempted to block every bot **→ then** Don’t. You’d block Google and Bing too, and vanish from search. Block the fakes, not the whole category. - **If** You block whole countries or hosting networks **→ then** Careful. Cloudflare warns this kind of rule can block real known bots by accident. Add “and not a Known Bot” to the rule. - **If** You want to show Googlebot a special version of your page **→ then** Don’t. Showing search engines different content from people is called cloaking. Google’s spam policies count it as spam. - **If** A plugin or rule lets anything named Googlebot skip a login or firewall **→ then** Remove that. The name is free to fake. - **If** Your site is small and fine **→ then** Leave it. Check Search Console once in a while and move on with your week. One more: if your Search Console suddenly shows crawl errors or pages dropping out right after you add a new block rule, the rule probably caught real Google. Undo it first, ask questions later. ## Do this today - [ ] Search any setting, plugin or server rule that says “allow Googlebot”. If it trusts the name alone, fix it. - [ ] Open Search Console. Look at Pages and, if you have a bigger site, Crawl stats. Make sure Google is still reaching you normally. - [ ] If your host has complained about load, pick three busy “Googlebot” IPs from your logs and run the `host` check on each. - [ ] On Cloudflare? Add the custom rule: user agent contains “Googlebot” and not a Known Bot → Block. Test that your site still loads. - [ ] On WordPress without Cloudflare? Open your security plugin’s rate limiting or crawler settings and look for the fake Google crawler option. - [ ] Never block “all bots”, and never serve Google a different page. ## Not-so-frequently asked questions ### Will blocking fake Googlebots hurt my rankings? Not if you block by failed checks, not by name. Real Googlebot passes the DNS check and sits in Google’s IP lists. Blocking the fakes is invisible to Google. ### Can’t I just block it in robots.txt? No. robots.txt is a polite request. Scrapers ignore it, and a fake Googlebot would read the Googlebot rules anyway. Illyes: “If you want to block, then you need something network level.” ### Are the fakes showing up in my Google Analytics? Mostly no. GA4 automatically leaves out known bots. Fakes show up in your server logs and hosting stats. ### Does this matter for AI crawlers too? Yes. The same trick works with any bot’s name. The same rule applies: check where the visit comes from, not what it calls itself. ## Things your agency won’t say - “Your site is under bot attack” is an easy line to sell a pricey plan with. Ask to see the numbers next to your Search Console data first. - Most small sites don’t have a fake Googlebot problem. Google’s own engineer said so. - The fix for most people is free: a CDN like Cloudflare, or a setting in a plugin you already have. ## Jargon Jail **Locked up: “User-agent”** The name tag a browser or bot sends with every visit, like “Googlebot” or “Chrome”. The visitor writes it, so anyone can write anything. **Useful for reading logs, useless as proof of who someone is.** For proof, check the IP address with a reverse and forward DNS lookup, or match it against Google’s published lists. ## Where to go next - [Two WordPress security scares in one week](/blog/wordpress-php-and-updraftplus-security-scares), if you run WordPress and want the full lock-check - [The scariest moments in digital marketing](/blog/scariest-moments-digital-marketers), including the day your pages quietly fall out of Google - [Meta wants to crawl your website](/blog/meta-crawling-terms-delayed), for more on crawlers and robots.txt - [What SEO actually is](/blog/what-is-seo), if crawling still feels like magic - [All our SEO notes](/seo) ## Sources 1. PPC Land, [Faking Googlebot takes 30 seconds, Google’s Gary Illyes says](https://ppc.land/faking-googlebot-takes-30-seconds-googles-gary-illyes-says/), the story that sent me here. 2. Odys Podcast, The High Stakes Growth Show with Gary Illyes, 28 October 2026: [episode page on Podbean](https://odyspodcast.podbean.com/e/1-anyone-can-fake-googlebot-in-30-seconds-ai-crawlers-robotstxt-and-web-bot-auth-gary-illyes-google/) and [transcript on Exa](https://exa.ai/library/podcast/lb45q0w00fg/episode/64lfbwb5yvr). Quotes in this note are from that transcript, which is auto-generated. 3. Google Search Central, [Verifying Googlebot and other Google crawlers](https://developers.google.com/search/docs/crawling-indexing/verifying-googlebot). 4. Google, [common-crawlers.json IP ranges](https://developers.google.com/static/crawling/ipranges/common-crawlers.json). 5. Google Search Console Help, [Crawl Stats report](https://support.google.com/webmasters/answer/9679690). 6. Google Search Central, [Spam policies for Google web search](https://developers.google.com/search/docs/essentials/spam-policies) (cloaking and scraped content). 7. Google Analytics Help, [Known bot-traffic exclusion](https://support.google.com/analytics/answer/9888366). 8. Cloudflare, [Verified bots](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/), [Allow traffic from verified bots](https://developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-verified-bots/), [Fake bot managed rules](https://developers.cloudflare.com/waf/troubleshooting/fake-bot-managed-rules/), [WAF FAQ](https://developers.cloudflare.com/waf/troubleshooting/faq/) and [Bot Fight Mode](https://developers.cloudflare.com/bots/get-started/bot-fight-mode/). 9. Wordfence, [How to configure Rate Limiting](https://www.youtube.com/watch?v=9mtGKVZcZAU) (video). ## Related notes - [This week in Google: report dates, answer-first pages, and AI Mode ads in India](https://dumbcmo.com/blog/search-console-dates-answer-first-pages-ai-mode-ads): Three things worth your time this week. Check the date on Search Console reports before you panic. Put the answer in the first lines of your pages. And expect “Sponsored” ads inside Google’s AI Mode in India, now that Google says AI Mode’s lower monetisation weighed on its search growth. - [Big brands win most AI answers. Here’s where small sites still get in](https://dumbcmo.com/blog/big-brands-ai-search-openings-small-sites): In BrightEdge’s holiday travel data, the biggest brands lead AI answers in every category. But they matter less on “inspire me” questions, where YouTube, Reddit and experience-led sites show up more. That’s your door: real experience, clear answers, honest comparisons, and saying where you work. - [Restaurants can now switch off delivery apps on their Google profile](https://dumbcmo.com/blog/google-business-profile-ordering-providers): Delivery and pickup apps used to show on your Google listing until you chased each one to remove you. Now you can switch a provider off yourself from your Business Profile, separately for pickup and delivery. Check which apps your customers see today. --- From [DumbCMO](https://dumbcmo.com): The marketing notes you were too embarrassed to take.