Overview
JavaScript leads Online Services's secondary barrier stack above the norm
| Value | |
|---|---|
| WAF | 93% |
| Antibot | 9% |
| CAPTCHA | 16% |
| JavaScript | 50% |
| Rate Limiting | 19% |
| TLS | 12% |
WAF at 93% is the dominant barrier. JavaScript (50%) leads secondary coverage. The remaining barriers sit materially lower, giving Online Services a narrow but defined secondary layer.
Barrier Landscape
Online Services combines modest technical barriers with aggressive AI-blocking policy
| Value | |
|---|---|
| WAF | 93% |
| Antibot | 9% |
| CAPTCHA | 16% |
| JavaScript | 50% |
| Rate Limiting | 19% |
| TLS | 12% |
| Has robots.txt | 86% |
| Blocks AI crawlers | 36% |
WAF leads at 93%. JavaScript (50%) and Rate Limiting (19%) are the main active layers. 36% of sites block AI crawlers via robots.txt — a policy emphasis that leads most surveyed sectors.
Two-barrier stacks are Online Services's most common security posture
| % of sites | |
|---|---|
| 0 barriers | 6% |
| 1 barrier | 31% |
| 2 barriers | 32% |
| 3 barriers | 22% |
| 4 barriers | 7% |
| 5 barriers | 2% |
| 6 barriers | 0% |
32% of Online Services sites carry exactly 2 barriers. 31% stack three or more. 6% carry none — a low share of unprotected sites for this sector.
Online Services is predominantly Easy to access — with a notable Moderate minority
| Mean recommended tier | |
|---|---|
| All sites | 2.34 |
A mean recommended tier of 2.34 and a median of Easy place Online Services toward the harder end of the sectors surveyed. 22% of sites are Simple to access; 36% require Moderate or above.
Easy is the most common access tier across Online Services sites
| % of sites | |
|---|---|
| 1 - Simple | 22% |
| 2 - Easy | 42% |
| 3 - Moderate | 21% |
| 4 - Complex | 10% |
| 5 - Advanced | 5% |
Easy (42%) is the most common tier. Simple and Easy together account for 64% of sites, while 21% land at Moderate and 15% at Complex or Advanced.
robots.txt
Most Online Services sites publish a robots.txt — coverage above the norm
| % of sites | |
|---|---|
| Publish a valid robots.txt | 86% |
86% of Online Services sites publish a valid robots.txt. The 14% without a file leave crawl policy undefined — a lower gap than the cross-sector average of around 24%.
Online Services's robots.txt files show moderate engagement with named bot policy
| % of sites | |
|---|---|
| 0 | 14% |
| 1 | 20% |
| 2–4 | 17% |
| 5–9 | 18% |
| 10–15 | 5% |
| 16+ | 26% |
A mean of 12.5 named agents reflects moderate bot-policy investment in Online Services. 14% of sites name no agents; 26% name 16 or more. The median of 4 suggests a bimodal split.
AI crawlers draw the most robots.txt attention in Online Services
| % of sites | |
|---|---|
| AI crawlers | 37% |
| SEO / search indexing | 30% |
| SEO audit tools | 26% |
| Commercial scrapers | 26% |
| Social / content scrapers | 21% |
| Archive / research crawlers | 7% |
| Monitoring / uptime bots | 1% |
AI crawlers are mentioned by 37% of Online Services sites — the leading bot category. SEO / search indexing follows at 30%. Figures are percentages of all 100 Online Services sites including those with no robots.txt.
A blanket Disallow: / posture appears in 9% of Online Services sites
| % of sites | |
|---|---|
| Uniform per-agent rules | 28% |
| Path-level mixed rules | 48% |
| Allow-only (no Disallow rules) | 0% |
| Mixed AI posture | 3% |
| Blanket Disallow: / | 9% |
Across all 100 Online Services sites surveyed, 9% issue a blanket Disallow: /. Path-level mixed rules is the dominant posture at 48% of all sites.
AI crawlers are among the most-targeted agents in Online Services robots.txt
| Disallowed | Allowed (whitelisted) | |
|---|---|---|
| * | 83% | 48% |
| Googlebot | 24% | 16% |
| GPTBot | 31% | 1% |
| Twitterbot | 15% | 15% |
| Google-Extended | 29% | 1% |
| ClaudeBot | 26% | — |
| PerplexityBot | 24% | 2% |
| Bytespider | 24% | — |
| CCBot | 23% | — |
| ChatGPT-User | 20% | 2% |
| PetalBot | 21% | — |
| omgili | 21% | — |
| Scrapy | 20% | — |
| Yandex | 11% | 8% |
| Diffbot | 19% | — |
| OAI-SearchBot | 16% | 1% |
| cohere-ai | 16% | — |
| FriendlyCrawler | 15% | — |
| YouBot | 15% | — |
| AI2Bot | 15% | — |
| Perplexity-User | 14% | 1% |
| meta-externalagent | 15% | — |
| AdsBot-Google | 8% | 6% |
| facebookexternalhit | 6% | 8% |
| img2dataset | 14% | — |
Values are percentages of all 100 Online Services sites surveyed. The wildcard (*) leads at 83% Disallow. Among named agents, GPTBot, Google-Extended lead the Disallow list — reflecting direct targeting of AI training and indexing bots.
Industry Cohort
Online Services leads the Technology cohort on AI-blocking policy
| WAF | Antibot | CAPTCHA | JavaScript | Rate Limit | TLS | robots.txt | Blocks AI | Tier | |
|---|---|---|---|---|---|---|---|---|---|
| Biotech | 89% | 13% | 19% | 39% | 17% | 13% | 76% | 14% | Tier 1 |
| Computer Software | 95% | 17% | 19% | 30% | 18% | 13% | 83% | 14% | Tier 2 |
| Information Technology | 94% | 13% | 15% | 36% | 21% | 14% | 68% | 7% | Tier 2 |
| Market Research | 94% | 16% | 22% | 44% | 25% | 14% | 71% | 0% | Tier 1 |
| Nanotechnology | 95% | 8% | 33% | 31% | 10% | 9% | 79% | 6% | Tier 1 |
| Online Services | 93% | 9% | 16% | 50% | 19% | 12% | 86% | 36% | Tier 2 |
| Security Products & Services | 91% | 19% | 26% | 40% | 15% | 12% | 73% | 4% | Tier 1 |
Online Services's 36% AI-blocking rate in robots.txt is the highest in the Technology cohort. WAF (93%) and JavaScript (50%) sit mid-table in the cohort on technical barriers.