Should Shopify merchants trust AI crawler logs that don’t verify where the bot came from?
Your server logs may say GPTBot visited a product page.
That can be useful. It is not proof that OpenAI sent the request.
A crawler identifies itself in several ways. The easiest one to copy is its user-agent string: the bit of text a request sends to say what it is. Anyone can send a request that says `GPTBot`, `ClaudeBot`, or `Googlebot`.
That matters if you are using crawler activity to understand whether AI systems can reach your store. A log full of familiar names can look reassuring. Some of those names may be real. Some may only be labels chosen by whoever sent the request.
A crawler name is a claim, not evidence
Shopify puts this plainly in its documentation: anyone can copy a user agent.
That is why a log entry such as this is incomplete:
```text User-Agent: GPTBot ```
It tells you what the request claimed to be. It does not tell you where it came from.
Think of it like a parcel with a return address. The address is worth reading, but you would not treat it as proof of who sent the parcel without another check.
For a crawler visit, that other check is often the IP address behind the request.
OpenAI publishes IP-range lists for its crawlers. Anthropic publishes source IP addresses too. A store, platform, or app can compare the request's address with the list the crawler company publishes.
If the address matches, there is evidence behind the crawler name. If it does not match, the request should not be counted as verified just because its user-agent string looked right.
Not all AI crawler names mean the same thing
It is also worth checking what a bot name is supposed to do.
OpenAI lists separate identities for different purposes:
- `OAI-SearchBot` is used for ChatGPT search.
- `GPTBot` may crawl content for foundation-model training.
- `ChatGPT-User` handles some user-directed requests and is not an automatic web crawler.
Those are different kinds of traffic. Counting them all as “ChatGPT visited” loses the useful part of the information.
Anthropic also separates its bots:
- `ClaudeBot` is for potential model-training data.
- `Claude-User` is for user-directed retrieval.
- `Claude-SearchBot` is for search indexing.
The label matters. So does whether the label can be checked.
If you are reviewing a crawler report, take a minute to look for the exact bot identity. A report that combines every bot into one large “AI crawler” number is easier to read, but harder to act on.
What a verified crawler visit can tell you
A verified visit tells you that a crawler associated with that company reached your store.
It does not tell you that the crawler understood every page.
It does not tell you that an assistant will mention your products.
It does not tell you that a shopper saw your store in an AI answer.
Those are separate questions.
A store can be reachable by crawlers and still have missing product details, weak policy pages, products hidden from search engines, or unclear product copy. It can also be named by an assistant without a recent crawler visit appearing in your own logs.
That is why crawler tracking should sit beside other checks, not replace them.
For example, you might see a verified `OAI-SearchBot` visit to a collection page. Then you could check whether the collection actually explains what it sells, links to live products, and gives an assistant enough detail to distinguish your products from similar ones.
The crawl is a signal that the door was open. It is not a verdict on what happened inside.
How Descriva handles crawler claims
Descriva tracks visits from AI crawlers that read your store's AI files. That includes crawlers such as GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Googlebot, and Bingbot.
It does not treat the user-agent name as enough on its own.
Descriva checks the visitor's address against the address ranges the crawler company publishes. Each visit is shown as one of these statuses:
- Verified
- Unverified
- Self-reported
That distinction is there because a crawler log without source checking can create false confidence.
You can switch crawler tracking on with one theme app embed. Once it is running, look beyond the total count. Check which crawler visited, which file it requested, and whether the visit was verified.
A visit to `llms.txt` is different from a visit to a product markdown page. A verified search crawler is different from a request that only claims to be one.
There are stronger ways to identify some bots
IP-range checks are not the only method.
Shopify supports cryptographic Web Bot Auth signatures for crawler requests. These use three headers:
- `Signature-Input`
- `Signature`
- `Signature-Agent`
A valid signature gives a stronger way to establish who sent a request than a user-agent string alone.
For Shopify's Cloudsurf traffic, Shopify says a valid Web Bot Auth signature is the most reliable identifier. An unsigned request that claims to be Cloudsurf cannot be verified as coming from Shopify. The same is true if its signature is invalid.
Cloudsurf signatures use a published key directory and expire shortly after they are created. That short lifetime helps limit how long a captured signature could be reused.
This is mostly useful context for merchants choosing tools or reviewing technical reports. You do not need to validate signatures by hand to run a store. But you should know the difference between a report that says “a request used this name” and one that says “we checked where this request came from.”
A one-minute check for your current reporting
Open the crawler report you use now, whether that is an app, hosting log, CDN dashboard, or analytics tool.
Look for one answer:
Does it say how it verifies crawler identity?
If the answer is only “we read the user-agent,” treat the names as unverified claims.
If it checks published IP ranges, ask whether it shows the result per visit. A total count without a verification status makes it hard to know what you are looking at.
If it supports signed bot requests, check whether it distinguishes a valid signature from a missing one.
You do not need perfect crawler data before you improve your store. You do need honest labels. A smaller count of verified visits is more useful than a larger count built from names anyone can copy.
Use crawler logs for the question they can answer
Crawler logs answer a narrow question: did a known crawler reach a page or file on your store?
They are good for spotting access problems. Say your robots.txt rules block a crawler you expected to allow. Or your product markdown pages return an error. A crawler report can help you find that.
They cannot answer whether assistants recommend you. For that, you need to ask the assistants the questions shoppers ask and see who they name.
Descriva keeps those views separate. Crawler tracking shows who reached your AI files. AI Mentions asks ChatGPT, Perplexity, Claude, and Gemini shopper questions and shows which answers named your store, which left it out, who appeared instead, and which sources were cited.
That separation is deliberate. A crawler visit is not a recommendation.
If you want to check your store before installing anything, the scan at lunalink.ai reads public store pages with no login or install. If you install Descriva, the first AI visibility check lets you choose one product and see three shopper questions asked across all four assistants before choosing a plan.