How to recognize it

User agent, as it reaches our logs:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)

A full Safari string with (Applebot/0.1; ...) at the end. Apple says the browser version in it may change. Match on Applebot, but not Applebot-Extended.

  • robots.txt token: Applebot
  • IP list (JSON): applebot.json
  • Reverse DNS: names under applebot.apple.com.

What it does

Applebot crawls for the search built into Apple’s products, such as Spotlight, Siri and Safari. Apple says the data may also be used to train its foundation models, which a site can refuse through the Applebot-Extended token. Applebot may render pages in a browser, so blocking JavaScript or CSS in robots.txt can stop it from seeing the content.

What you gain by allowing it

  • Appearing, with links, in Siri and Spotlight suggestions and Safari search on Apple devices.

What you lose

By allowing it

  • Crawl load, a full page render each time; Crawl-delay does not slow it down.
  • Use in training Apple’s foundation models, unless you disallow Applebot-Extended.

By blocking it

  • Search on Apple devices. To stay in that search but out of training, disallow Applebot-Extended instead.

How to verify it

Reverse DNS to a name under applebot.apple.com, confirmed forward, or a match against applebot.json. Cloudflare flags the real crawler as a verified bot, in the category “AI Search”; in our data the flag matched our check on every request.

Gotchas and history

  • Googlebot rules apply: a robots.txt with Googlebot rules but no Applebot group gives Applebot the Googlebot rules. Blocking Googlebot from a section blocks Applebot from it too.
  • Rendering: it renders. Blocked scripts and stylesheets mean Apple indexes a broken page.
  • Category labels: Cloudflare files it under “AI Search”, while Apple describes a search crawler that may also feed training.

What we observed

Data: Cloudflare Logpush for two of our sites, 19-26 October 2026 (8 days).

  • 1,444 requests carried an Applebot user agent:
    • exactly half, 722, passed forward-confirmed reverse DNS, all from Apple’s network (AS714);
    • 716 of the 722 fakes came from the Google Cloud scanner.
  • 207 of the 722 verified requests (29%) were for scripts and stylesheets, which is what rendering looks like. 53 were for /robots.txt.
  • 31 got a 404 and 2 a 403.

About Apple

  • Applebot crawls for the search in Spotlight, Siri and Safari. It may also feed training of Apple’s foundation models. With no Applebot group in robots.txt, it follows the Googlebot group.
  • Applebot-Extended is a robots.txt token, not a crawler. It decides whether Applebot’s data may train Apple’s general purpose foundation models, without affecting search.

One crawler, two decisions. To stay in Apple’s search but out of training, allow Applebot and disallow Applebot-Extended.

Sources