Overview
JavaScript and Rate Limiting both elevate Hospitality's active barrier profile
| Value | |
|---|---|
| WAF | 86% |
| Antibot | 18% |
| CAPTCHA | 17% |
| JavaScript | 47% |
| Rate Limiting | 27% |
| TLS | 19% |
WAF leads at 86%. JavaScript (47%) and Rate Limiting (27%) together form a multi-layer active stack — more than most sectors deploy alongside WAF.
Barrier Landscape
JavaScript is Hospitality's dominant secondary barrier by a wide margin
| Value | |
|---|---|
| WAF | 86% |
| Antibot | 18% |
| CAPTCHA | 17% |
| JavaScript | 47% |
| Rate Limiting | 27% |
| TLS | 19% |
| Has robots.txt | 76% |
| Blocks AI crawlers | 9% |
WAF at 86% and JavaScript at 47% together form the sector's main defensive layer. Rate Limiting (27%) follows at a distance. The barrier profile is concentrated rather than broadly spread.
Two-barrier stacks are Hospitality's most common security posture
| % of sites | |
|---|---|
| 0 barriers | 10% |
| 1 barrier | 26% |
| 2 barriers | 28% |
| 3 barriers | 20% |
| 4 barriers | 10% |
| 5 barriers | 4% |
| 6 barriers | 2% |
28% of Hospitality sites carry exactly 2 barriers. 36% stack three or more. 10% carry none — a moderate share of unprotected sites for this sector.
Nearly half of Hospitality sites are Simple to access
| Mean recommended tier | |
|---|---|
| All sites | 1.86 |
A mean recommended tier of 1.86 and a median of Easy place Hospitality around the middle of the sectors surveyed. 46% of sites are Simple to access; 21% require Moderate or above.
Simple is the dominant tier in Hospitality, but Easy accounts for a significant share
| % of sites | |
|---|---|
| 1 - Simple | 46.5% |
| 2 - Easy | 32.3% |
| 3 - Moderate | 11.1% |
| 4 - Complex | 9.1% |
| 5 - Advanced | 1% |
Simple (46%) is the most common tier. Simple and Easy together account for 79% of sites, while 11% land at Moderate and 10% at Complex or Advanced.
robots.txt
Around three-quarters of Hospitality sites publish a robots.txt
| % of sites | |
|---|---|
| Publish a valid robots.txt | 76% |
76% of Hospitality sites have a valid robots.txt. The remaining 24% leave crawl policy entirely undefined — a meaningful gap for a sector of this scale.
Hospitality sites name a handful of agents in robots.txt — few commit to comprehensive policies
| % of sites | |
|---|---|
| 0 | 26% |
| 1 | 38% |
| 2–4 | 15% |
| 5–9 | 9% |
| 10–15 | 6% |
| 16+ | 6% |
The mean of 9.9 named agents reflects limited bot-policy investment in Hospitality. 26% of sites name no agents; 38% name exactly one. Only 6% maintain a list of 16 or more named bots.
AI crawlers and SEO / search indexing draw near-equal attention in Hospitality robots.txt
| % of sites | |
|---|---|
| AI crawlers | 16% |
| SEO / search indexing | 16% |
| SEO audit tools | 11% |
| Commercial scrapers | 5% |
| Social / content scrapers | 4% |
| Archive / research crawlers | 7% |
| Monitoring / uptime bots | 1% |
AI crawlers appears in 16% of Hospitality sites; SEO / search indexing in 16%. The near-equal split reflects a sector that treats both categories with comparable priority. Figures are percentages of all 100 sites.
Path-level mixed rules dominate Hospitality robots.txt posture
| % of sites | |
|---|---|
| Uniform per-agent rules | 34% |
| Path-level mixed rules | 35% |
| Allow-only (no Disallow rules) | 4% |
| Mixed AI posture | 3% |
| Blanket Disallow: / | 3% |
Path-level mixed rules lead at 35%, with uniform per-agent rules at 34%. Mixed AI posture reaches 3%.
AdsBot-Google leads named Disallow rules in Hospitality robots.txt
| Disallowed | Allowed (whitelisted) | |
|---|---|---|
| * | 68% | 33% |
| AdsBot-Google | 9% | 9% |
| AdsBot-Google-Mobile | 6% | 8% |
| AdIdxBot | 4% | 7% |
| ChatGPT-User | 4% | 7% |
| PerplexityBot | 4% | 7% |
| Mediapartners-Google | 5% | 6% |
| Googlebot | 6% | 4% |
| google-hoteladsverifier | 4% | 6% |
| Bingbot | 4% | 3% |
| Claude-SearchBot | 2% | 5% |
| Claude-User | 2% | 5% |
| OAI-SearchBot | 2% | 5% |
| SemrushBot | 6% | 1% |
| Baiduspider | 5% | 1% |
| AhrefsBot | 5% | 1% |
| Perplexity-User | 2% | 4% |
| GPTBot | 4% | 2% |
| Yandex | 4% | 1% |
| Twitterbot | 3% | 2% |
| ClaudeBot | 3% | 2% |
| Applebot | 3% | 1% |
| TurnitinBot | 4% | — |
| psbot | 4% | — |
| Facebot | 2% | 2% |
Values are percentages of all 100 Hospitality sites surveyed. The wildcard (*) leads at 68% Disallow. Among named agents, AdsBot-Google, AdsBot-Google-Mobile, Googlebot are the most frequently targeted — focused on non-AI crawlers.
Industry Cohort
Hospitality sits mid-table within the Travel & Hospitality cohort
| WAF | Antibot | CAPTCHA | JavaScript | Rate Limit | TLS | robots.txt | Blocks AI | Tier | |
|---|---|---|---|---|---|---|---|---|---|
| Airlines | 76% | 24% | 11% | 51% | 27% | 22% | 69% | 9% | Tier 2 |
| Events Services | 83% | 17% | 21% | 41% | 26% | 12% | 65% | 3% | Tier 1 |
| Hospitality | 86% | 18% | 17% | 47% | 27% | 19% | 76% | 9% | Tier 2 |
| Recreational Facilities | 95% | 23% | 21% | 51% | 21% | 11% | 71% | 6% | Tier 1 |
| Restaurants | 91% | 28% | 19% | 57% | 41% | 15% | 50% | 5% | Tier 2 |
| Travel & Tourism | 81% | 27% | 8% | 55% | 31% | 26% | 78% | 21% | Tier 2 |
Across Travel & Hospitality, Hospitality's barrier rates are broadly in line with peers. WAF at 86%, JavaScript at 47%, and AI blocking at 9% all sit near the cohort median. Tier difficulty (mean 1.78) is above the group average.