What is Bytespider? How to allow or block ByteDance's crawler

Bytespider is ByteDance's web crawler for collecting AI training data. ByteDance's crawler, used for training its AI models.

ByteDance publishes no crawler documentation, and multiple independent reports have found Bytespider ignoring robots.txt; blocking it reliably requires firewall or CDN rules.

Add "User-agent: Bytespider" followed by "Disallow: /" to your robots.txt file. Because this bot's robots.txt compliance is not reliable, enforce the block with firewall or CDN rules (for example a Cloudflare WAF rule matching the user agent) if it matters to you.

No. Bytespider is separate from Googlebot, which handles Google Search indexing. Blocking Bytespider has no effect on your traditional search rankings.

Search your server access logs for the string "Bytespider" — for example: grep -i "Bytespider" /var/log/nginx/access.log | wc -l. Our free AI Bot Log Analyzer does this in your browser: paste a log file and it counts hits per AI crawler, including Bytespider, with per-path breakdowns.

You don't — Bytespider isn't a tool you run. It's ByteDance's own crawler, operated by ByteDance, that visits your site from their infrastructure. The only control you have over it is whether you allow or block it, via robots.txt or a server rule. If you're looking to crawl other sites yourself, you'd write your own crawler or use a crawling library; sending "Bytespider" as your user agent would be impersonating ByteDance.

Almost certainly not. Crawl-delay was never part of the original robots.txt specification — Google has publicly said it ignores the directive, and the AI crawlers that model their parsers on Google's do the same. ByteDance publishes no position on crawl-delay for Bytespider, so treat it as unsupported. If Bytespider is hitting your site harder than you want, rate-limit it at the server or CDN instead: a Cloudflare rate-limiting rule or an nginx limit_req zone matched on the user agent will actually be enforced, whereas a crawl-delay line is only a request that this agent likely never reads.

ByteDance makes no enforceable commitment that Bytespider honors robots.txt, so the plain answer may be that it simply does not. Before assuming that, rule out the ordinary causes: a cached copy of robots.txt from before your change, a user-agent line that does not actually match, or a block placed in a group this agent does not read. If the hits continue after those are excluded, robots.txt is not going to stop this agent and you need a firewall or CDN rule that returns 403.

Treat it as no unless ByteDance says otherwise. Rendering JavaScript costs an order of magnitude more than fetching HTML, and most AI crawlers — unlike Googlebot, which runs a full headless Chrome — read the raw HTML response and stop there. The practical consequence: anything your page loads client-side after the initial response is likely invisible to Bytespider. If your main content is client-rendered, server-render it or pre-render it so the text exists in the first response.

ByteDance publishes no IP-range file for Bytespider, which means there is no way to verify a request really came from them. Any traffic claiming this user agent should be treated as unverified. If you need certainty, block on the user agent and accept that you may be blocking impostors rather than the real crawler — and note that the absence of published ranges is itself a signal about how seriously the operator treats crawler transparency.

There is no published schedule, and no operator commits to one. Training crawlers like Bytespider typically sweep in bursts rather than at a steady rate — quiet for weeks, then hundreds of requests over a day or two as a collection run reaches your domain. Larger and more-linked sites are revisited more often. The only way to know for your own site is to measure it: grep your access log for the user agent, or paste the log into our AI Bot Log Analyzer, which breaks hits down by date and path in your browser.

ByteDance publishes no official documentation for Bytespider. That absence is itself worth noting: an undocumented crawler gives you no stated policy to hold it to, and no published IP ranges to verify it against.