Overview
JavaScript leads Public Policy's secondary barrier stack above the norm
| Value | |
|---|---|
| WAF | 96% |
| Antibot | 9% |
| CAPTCHA | 9% |
| JavaScript | 28% |
| Rate Limiting | 11% |
| TLS | 9% |
WAF at 96% is the dominant barrier. JavaScript (28%) leads secondary coverage. The remaining barriers sit materially lower, giving Public Policy a narrow but defined secondary layer.
Barrier Landscape
WAF leads Public Policy at 96% — JavaScript is the main secondary layer
| Value | |
|---|---|
| WAF | 96% |
| Antibot | 9% |
| CAPTCHA | 9% |
| JavaScript | 28% |
| Rate Limiting | 11% |
| TLS | 9% |
| Has robots.txt | 86% |
| Blocks AI crawlers | 8% |
WAF dominates at 96%. JavaScript (28%) leads active secondary barriers, followed by Rate Limiting (11%). The remaining three barriers all sit at or below 9% — a concentrated rather than broadly stacked profile.
Single-barrier configurations dominate Public Policy — mostly WAF alone
| % of sites | |
|---|---|
| 0 barriers | 4% |
| 1 barrier | 53% |
| 2 barriers | 29% |
| 3 barriers | 8% |
| 4 barriers | 3% |
| 5 barriers | 3% |
| 6 barriers | 0% |
53% of Public Policy sites carry exactly one barrier — almost always WAF. Two-barrier stacks add 29%. Just 14% of sites layer three or more defences.
Nearly all Public Policy sites are Simple to access programmatically
| Mean recommended tier | |
|---|---|
| All sites | 1.11 |
A mean recommended tier of 1.11 and a median of Simple place Public Policy among the most accessible sectors surveyed. 94% of sites are Simple to access; 2% require Moderate or above.
Simple tier covers more than three-quarters of Public Policy sites
| % of sites | |
|---|---|
| 1 - Simple | 94% |
| 2 - Easy | 4% |
| 3 - Moderate | 0% |
| 4 - Complex | 1% |
| 5 - Advanced | 1% |
Simple (94%) is the most common tier. Simple and Easy together account for 98% of sites, while 0% land at Moderate and 2% at Complex or Advanced.
robots.txt
Most Public Policy sites publish a robots.txt — coverage above the norm
| % of sites | |
|---|---|
| Publish a valid robots.txt | 86% |
86% of Public Policy sites publish a valid robots.txt. The 14% without a file leave crawl policy undefined — a lower gap than the cross-sector average of around 24%.
Public Policy sites name a handful of agents in robots.txt — few commit to comprehensive policies
| % of sites | |
|---|---|
| 0 | 24% |
| 1 | 57% |
| 2–4 | 3% |
| 5–9 | 10% |
| 10–15 | 1% |
| 16+ | 5% |
The mean of 2.6 named agents reflects limited bot-policy investment in Public Policy. 24% of sites name no agents; 57% name exactly one. Only 5% maintain a list of 16 or more named bots.
SEO audit tools lead Public Policy's robots.txt mentions ahead of AI crawlers
| % of sites | |
|---|---|
| AI crawlers | 8% |
| SEO / search indexing | 7% |
| SEO audit tools | 12% |
| Commercial scrapers | 2% |
| Social / content scrapers | 0% |
| Archive / research crawlers | 1% |
| Monitoring / uptime bots | 0% |
SEO audit tools are mentioned by 12% of Public Policy sites — the leading bot category, ahead of AI crawlers at 8%. Figures are percentages of all 100 sites surveyed.
Path-level mixed rules dominate Public Policy robots.txt posture
| % of sites | |
|---|---|
| Uniform per-agent rules | 33% |
| Path-level mixed rules | 48% |
| Allow-only (no Disallow rules) | 4% |
| Mixed AI posture | 0% |
| Blanket Disallow: / | 1% |
Path-level mixed rules lead at 48%, with uniform per-agent rules at 33%. Mixed AI posture reaches 0%.
MJ12bot leads named Disallow rules in Public Policy robots.txt
| Disallowed | Allowed (whitelisted) | |
|---|---|---|
| * | 67% | 52% |
| MJ12bot | 10% | — |
| PetalBot | 9% | — |
| SemrushBot | 8% | — |
| Yandex | 7% | 1% |
| AhrefsBot | 7% | — |
| ClaudeBot | 7% | — |
| GPTBot | 7% | — |
| Bytespider | 4% | — |
| Amazonbot | 3% | — |
| DotBot | 3% | — |
| Google-Extended | 3% | — |
| MauiBot | 3% | — |
| meta-externalagent | 3% | — |
| anthropic-ai | 3% | — |
| SemrushBot-SA | 3% | — |
| Baiduspider | 3% | — |
| Yeti | 2% | 1% |
| Googlebot-Image | 2% | 1% |
| CCBot | 2% | — |
| ChatGPT-User | 2% | — |
| PerplexityBot | 2% | — |
| GoogleBot | 1% | 1% |
| Claude-Web | 2% | — |
| Diffbot | 2% | — |
Values are percentages of all 100 Public Policy sites surveyed. The wildcard (*) leads at 67% Disallow. Among named agents, MJ12bot, PetalBot, SemrushBot are the most frequently targeted — focused on non-AI crawlers.
Industry Cohort
Public Policy sits mid-table within the Public Sector cohort
| WAF | Antibot | CAPTCHA | JavaScript | Rate Limit | TLS | robots.txt | Blocks AI | Tier | |
|---|---|---|---|---|---|---|---|---|---|
| Government | 80% | 10% | 8% | 33% | 15% | 12% | 64% | 10% | Tier 2 |
| Military | 77% | 11% | 16% | 21% | 19% | 17% | 62% | 7% | Tier 1 |
| Political Organizations | 97% | 13% | 23% | 47% | 16% | 9% | 79% | 6% | Tier 1 |
| Public Policy | 96% | 9% | 9% | 28% | 11% | 9% | 86% | 8% | Tier 1 |
| Public Safety | 94% | 12% | 25% | 44% | 18% | 14% | 74% | 6% | Tier 1 |
Across Public Sector, Public Policy's barrier rates are broadly in line with peers. WAF at 96%, JavaScript at 28%, and AI blocking at 8% all sit near the cohort median. Tier difficulty (mean 1.11) is above the group average.