Loading
AI crawler profile
User-agent string to match in robots.txt and server logs: Bytespider
Operator
ByteDance
Purpose
AI model training
robots.txt
Ignores robots.txt
Official docs
None published
Bytespider is ByteDance's aggressive web crawler, believed to gather training data for its AI products including the Doubao models. It has drawn criticism for crawling at very high volume and for continuing to fetch pages on sites that have disallowed it.
ByteDance publishes no crawler documentation, and multiple independent reports have found Bytespider ignoring robots.txt; blocking it reliably requires firewall or CDN rules.
ByteDance publishes no IP-range file for Bytespider, so it can only be identified by its user-agent string — which anything can send. Treat traffic claiming this agent as unverified, and prefer a reverse-DNS check where the operator documents one before acting on it.
User-agent: Bytespider Disallow: /
⚠ Because Bytespider's robots.txt compliance is unreliable, pair this with a firewall or CDN rule matching the user-agent string if blocking actually matters to you.
User-agent: Bytespider Allow: /
Bytespider's robots.txt compliance is absent, so a robots.txt rule alone may not stop it. These enforce the block. Matching on the user-agent string still trusts a self-declared header — and no IP-range file exists for this agent, so treat it as best-effort.
if ($http_user_agent ~* "Bytespider") {
return 403;
}RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} Bytespider [NC]
RewriteRule .* - [F,L](http.user_agent contains "Bytespider")
grep -i "Bytespider" /var/log/nginx/access.log | wc -l
Blocking Bytespider opts your content out of ByteDance's model training — a legitimate choice for original content you don't want reproduced by AI. The trade-off: models trained without your content are less likely to know your brand or recommend it unprompted. There is no direct traffic loss today, since training crawlers don't send visitors. See our guide on whether to block AI bots for the full decision framework.
Bytespider is ByteDance's web crawler for collecting AI training data. ByteDance's crawler, used for training its AI models.
ByteDance publishes no crawler documentation, and multiple independent reports have found Bytespider ignoring robots.txt; blocking it reliably requires firewall or CDN rules.
Add "User-agent: Bytespider" followed by "Disallow: /" to your robots.txt file. Because this bot's robots.txt compliance is not reliable, enforce the block with firewall or CDN rules (for example a Cloudflare WAF rule matching the user agent) if it matters to you.
No. Bytespider is separate from Googlebot, which handles Google Search indexing. Blocking Bytespider has no effect on your traditional search rankings.
Search your server access logs for the string "Bytespider" — for example: grep -i "Bytespider" /var/log/nginx/access.log | wc -l. Our free AI Bot Log Analyzer does this in your browser: paste a log file and it counts hits per AI crawler, including Bytespider, with per-path breakdowns.
You don't — Bytespider isn't a tool you run. It's ByteDance's own crawler, operated by ByteDance, that visits your site from their infrastructure. The only control you have over it is whether you allow or block it, via robots.txt or a server rule. If you're looking to crawl other sites yourself, you'd write your own crawler or use a crawling library; sending "Bytespider" as your user agent would be impersonating ByteDance.
Almost certainly not. Crawl-delay was never part of the original robots.txt specification — Google has publicly said it ignores the directive, and the AI crawlers that model their parsers on Google's do the same. ByteDance publishes no position on crawl-delay for Bytespider, so treat it as unsupported. If Bytespider is hitting your site harder than you want, rate-limit it at the server or CDN instead: a Cloudflare rate-limiting rule or an nginx limit_req zone matched on the user agent will actually be enforced, whereas a crawl-delay line is only a request that this agent likely never reads.
ByteDance makes no enforceable commitment that Bytespider honors robots.txt, so the plain answer may be that it simply does not. Before assuming that, rule out the ordinary causes: a cached copy of robots.txt from before your change, a user-agent line that does not actually match, or a block placed in a group this agent does not read. If the hits continue after those are excluded, robots.txt is not going to stop this agent and you need a firewall or CDN rule that returns 403.
Treat it as no unless ByteDance says otherwise. Rendering JavaScript costs an order of magnitude more than fetching HTML, and most AI crawlers — unlike Googlebot, which runs a full headless Chrome — read the raw HTML response and stop there. The practical consequence: anything your page loads client-side after the initial response is likely invisible to Bytespider. If your main content is client-rendered, server-render it or pre-render it so the text exists in the first response.
ByteDance publishes no IP-range file for Bytespider, which means there is no way to verify a request really came from them. Any traffic claiming this user agent should be treated as unverified. If you need certainty, block on the user agent and accept that you may be blocking impostors rather than the real crawler — and note that the absence of published ranges is itself a signal about how seriously the operator treats crawler transparency.
There is no published schedule, and no operator commits to one. Training crawlers like Bytespider typically sweep in bursts rather than at a steady rate — quiet for weeks, then hundreds of requests over a day or two as a collection run reaches your domain. Larger and more-linked sites are revisited more often. The only way to know for your own site is to measure it: grep your access log for the user agent, or paste the log into our AI Bot Log Analyzer, which breaks hits down by date and path in your browser.
ByteDance publishes no official documentation for Bytespider. That absence is itself worth noting: an undocumented crawler gives you no stated policy to hold it to, and no published IP ranges to verify it against.
Part of our directory of every known AI crawler, refreshed monthly. Last verified: 2026-09-13.