Overview
JavaScript and CAPTCHA both elevate Museums's active barrier profile
| Value | |
|---|---|
| WAF | 95% |
| Antibot | 27% |
| CAPTCHA | 32% |
| JavaScript | 43% |
| Rate Limiting | 22% |
| TLS | 13% |
WAF leads at 95%. JavaScript (43%) and CAPTCHA (32%) together form a multi-layer active stack — more than most sectors deploy alongside WAF.
Barrier Landscape
WAF leads Museums at 95% — JavaScript is the main secondary layer
| Value | |
|---|---|
| WAF | 95% |
| Antibot | 27% |
| CAPTCHA | 32% |
| JavaScript | 43% |
| Rate Limiting | 22% |
| TLS | 13% |
| Has robots.txt | 78% |
| Blocks AI crawlers | 13% |
WAF dominates at 95%. JavaScript (43%) leads active secondary barriers, followed by CAPTCHA (32%). The remaining three barriers all sit at or below 27% — a concentrated rather than broadly stacked profile.
Two-barrier stacks are Museums's most common security posture
| % of sites | |
|---|---|
| 0 barriers | 5% |
| 1 barrier | 28% |
| 2 barriers | 34% |
| 3 barriers | 13% |
| 4 barriers | 5% |
| 5 barriers | 13% |
| 6 barriers | 2% |
34% of Museums sites carry exactly 2 barriers. 33% stack three or more. 5% carry none — a low share of unprotected sites for this sector.
Simple is the dominant access tier across Museums
| Mean recommended tier | |
|---|---|
| All sites | 1.49 |
A mean recommended tier of 1.49 and a median of Simple place Museums toward the easier end of the sectors surveyed. 64% of sites are Simple to access; 9% require Moderate or above.
Simple is the dominant tier in Museums, but Easy accounts for a significant share
| % of sites | |
|---|---|
| 1 - Simple | 64% |
| 2 - Easy | 27% |
| 3 - Moderate | 5% |
| 4 - Complex | 4% |
| 5 - Advanced | 0% |
Simple (64%) is the most common tier. Simple and Easy together account for 91% of sites, while 5% land at Moderate and 4% at Complex or Advanced.
robots.txt
Nearly four in five of Museums sites publish a robots.txt
| % of sites | |
|---|---|
| Publish a valid robots.txt | 78% |
78% of Museums sites have a valid robots.txt. The remaining 22% leave crawl policy entirely undefined — a meaningful gap for a sector of this scale.
Museums sites name a handful of agents in robots.txt — few commit to comprehensive policies
| % of sites | |
|---|---|
| 0 | 29% |
| 1 | 46% |
| 2–4 | 9% |
| 5–9 | 6% |
| 10–15 | 3% |
| 16+ | 7% |
The mean of 9.3 named agents reflects limited bot-policy investment in Museums. 29% of sites name no agents; 46% name exactly one. Only 7% maintain a list of 16 or more named bots.
AI crawlers draw the most robots.txt attention in Museums
| % of sites | |
|---|---|
| AI crawlers | 13% |
| SEO / search indexing | 6% |
| SEO audit tools | 6% |
| Commercial scrapers | 5% |
| Social / content scrapers | 0% |
| Archive / research crawlers | 1% |
| Monitoring / uptime bots | 0% |
AI crawlers are named in 13% of Museums robots.txt files, followed by SEO / search indexing at 6%. All figures are percentages of all 100 sites including those with no robots.txt.
Uniform per-agent rules dominate Museums robots.txt files
| % of sites | |
|---|---|
| Uniform per-agent rules | 36% |
| Path-level mixed rules | 36% |
| Allow-only (no Disallow rules) | 5% |
| Mixed AI posture | 2% |
| Blanket Disallow: / | 1% |
Uniform per-agent rules lead at 36%, with path-level mixed rules at 36%. Mixed AI posture (2%) and blanket Disallow (1%) are minimal.
AI crawlers are among the most-targeted agents in Museums robots.txt
| Disallowed | Allowed (whitelisted) | |
|---|---|---|
| * | 63% | 43% |
| CCBot | 11% | — |
| GPTBot | 9% | 1% |
| Bytespider | 7% | — |
| ChatGPT-User | 6% | 1% |
| ClaudeBot | 7% | — |
| Google-Extended | 7% | — |
| PerplexityBot | 5% | 1% |
| AhrefsBot | 5% | — |
| Claude-Web | 4% | — |
| OAI-SearchBot | 3% | 1% |
| anthropic-ai | 4% | — |
| cohere-ai | 4% | — |
| Amazonbot | 4% | — |
| Sogou web spider | 4% | — |
| Baiduspider | 3% | — |
| Bingbot | 3% | — |
| Googlebot | 3% | — |
| Googlebot-Image | 3% | — |
| Slurp | 3% | — |
| Yandex | 3% | — |
| Applebot-Extended | 3% | — |
| Diffbot | 3% | — |
| FacebookBot | 3% | — |
| Meta-ExternalAgent | 3% | — |
Values are percentages of all 100 Museums sites surveyed. The wildcard (*) leads at 63% Disallow. Among named agents, CCBot, GPTBot lead the Disallow list — reflecting direct targeting of AI training and indexing bots.
Industry Cohort
Museums leads the Nonprofit cohort on AI-blocking policy
| WAF | Antibot | CAPTCHA | JavaScript | Rate Limit | TLS | robots.txt | Blocks AI | Tier | |
|---|---|---|---|---|---|---|---|---|---|
| Museums | 95% | 27% | 32% | 43% | 22% | 13% | 78% | 13% | Tier 1 |
| Nonprofit Organizations | 96% | 18% | 19% | 45% | 24% | 17% | 83% | 10% | Tier 2 |
| Religion & Belief | 96% | 22% | 26% | 32% | 19% | 13% | 89% | 10% | Tier 1 |
| Social & Charitable Organizations | 94% | 22% | 31% | 38% | 20% | 11% | 79% | 5% | Tier 1 |
Museums's 13% AI-blocking rate in robots.txt is the highest in the Nonprofit cohort. WAF (95%) and JavaScript (43%) sit mid-table in the cohort on technical barriers.