noul-bot
noul measures whether AI answer engines cite a website, and helps its owner get cited. To do that it reads a few pages of the sites its users add. This page says what those requests are and how to stop them.
How to recognise it
Every request carries one product token, noul-bot, followed by a purpose word:
Mozilla/5.0 (compatible; noul-bot/1.0; +https://noul.cc/bot; crawler-access-check)
Match on noul-bot. Everything after it is diagnostic.
What each purpose means
| Purpose | When it happens | What it reads |
|---|---|---|
site-setup | A user adds their site, asks for question suggestions, or proves they own it. | The homepage, up to 14 pages linked from it (for their titles), the sitemap (up to 5 child sitemaps), and the ownership file /.well-known/noul-verify.txt. |
crawler-access-check | A user runs "Can engines reach you?" on their own site (the step also reads the sitemap, under site-setup). | robots.txt and the homepage. See the note below on crawler names. |
action-check | A user marks a suggested action as done, and we check it happened. | The one page the action names: the user's own page, or a public listing page that should now mention them. |
citation-link | Google AI Mode cites a page through a google.com/goto link while we measure a user's questions. | Nothing on the cited site: one request to Google to read where the link points, without following it. |
site-check | Any other one-off check a user starts on their own site. | The page being checked. |
Crawler names in the access check
A site owner often can't tell whether their firewall turns away an AI crawler even though robots.txt allows it. A firewall rule that matches a crawler's name only fires on a request that carries that name. So, during crawler-access-check only, we send one homepage request per crawler with that crawler's token first and ours after it:
Mozilla/5.0 (compatible; GPTBot/1.3; +https://openai.com/gptbot; via noul-bot/1.0; +https://noul.cc/bot; crawler-access-check)
The crawlers checked this way are OAI-SearchBot, PerplexityBot, GPTBot and ClaudeBot. That is one request each, only when a user runs the check on their own site. These requests do not come from those companies, and a rule that blocks noul-bot still matches them.
What it doesn't do
- It doesn't crawl. Every request is one page a noul user's action asked for, or, for
citation-link, one lookup at Google during the weekly measurement the user approved. Nothing follows links beyond the pages listed forsite-setup. - It doesn't train models, and it doesn't resell what it reads.
- It doesn't read
robots.txtas a crawler would, because it makes one-off checks a person started, not a crawl. It readsrobots.txtduring the access check to tell the site owner what it allows. - No noul request uses a disguised browser agent. If that ever changes, it will be listed here first.
How to block it
Return 403 to any request whose User-Agent contains noul-bot. That covers every purpose above, including the access-check requests. For a site behind Cloudflare, a WAF custom rule does it:
(http.user_agent contains "noul-bot") → Block
A noul user whose site blocks it will see their checks report "couldn't reach the site", which is accurate.