Overview
Travel & Tourism's WAF coverage is unusually low — active barriers carry the load
| Value | |
|---|---|
| WAF | 81% |
| Antibot | 27% |
| CAPTCHA | 8% |
| JavaScript | 55% |
| Rate Limiting | 31% |
| TLS | 26% |
WAF covers only 81% of Travel & Tourism sites, well below the global norm. JavaScript (55%) and Rate Limiting (31%) absorb the defensive weight in a sector that leans on active challenge layers over firewall coverage.
Barrier Landscape
JavaScript and Rate Limiting define Travel & Tourism's layered active defences
| Value | |
|---|---|
| WAF | 81% |
| Antibot | 27% |
| CAPTCHA | 8% |
| JavaScript | 55% |
| Rate Limiting | 31% |
| TLS | 26% |
| Has robots.txt | 78% |
| Blocks AI crawlers | 21% |
WAF leads at 81%. JavaScript (55%) and Rate Limiting (31%) are both well above the cross-sector norm, giving Travel & Tourism a markedly heavier active barrier profile than most sectors.
Three-barrier stacks are Travel & Tourism's most common security posture
| % of sites | |
|---|---|
| 0 barriers | 11% |
| 1 barrier | 21% |
| 2 barriers | 24% |
| 3 barriers | 26% |
| 4 barriers | 11% |
| 5 barriers | 5% |
| 6 barriers | 2% |
26% of Travel & Tourism sites carry exactly 3 barriers. 44% stack three or more. 11% carry none — a moderate share of unprotected sites for this sector.
Travel & Tourism is predominantly Easy to access — with a notable Moderate minority
| Mean recommended tier | |
|---|---|
| All sites | 2.19 |
A mean recommended tier of 2.19 and a median of Easy place Travel & Tourism toward the harder end of the sectors surveyed. 27% of sites are Simple to access; 28% require Moderate or above.
Easy is the most common access tier across Travel & Tourism sites
| % of sites | |
|---|---|
| 1 - Simple | 27.3% |
| 2 - Easy | 44.4% |
| 3 - Moderate | 14.1% |
| 4 - Complex | 10.1% |
| 5 - Advanced | 4% |
Easy (44%) is the most common tier. Simple and Easy together account for 72% of sites, while 14% land at Moderate and 14% at Complex or Advanced.
robots.txt
Nearly four in five Travel & Tourism sites publish a robots.txt
| % of sites | |
|---|---|
| Publish a valid robots.txt | 78% |
78% of Travel & Tourism sites have a valid robots.txt. The remaining 22% leave crawl policy entirely undefined — a meaningful gap for a sector of this scale.
Travel & Tourism sites name a handful of agents in robots.txt — few commit to comprehensive policies
| % of sites | |
|---|---|
| 0 | 25% |
| 1 | 19% |
| 2–4 | 16% |
| 5–9 | 14% |
| 10–15 | 12% |
| 16+ | 14% |
The mean of 8.5 named agents reflects limited bot-policy investment in Travel & Tourism. 25% of sites name no agents; 19% name exactly one. Only 14% maintain a list of 16 or more named bots.
AI crawlers draw the most robots.txt attention in Travel & Tourism
| % of sites | |
|---|---|
| AI crawlers | 28% |
| SEO / search indexing | 20% |
| SEO audit tools | 20% |
| Commercial scrapers | 6% |
| Social / content scrapers | 3% |
| Archive / research crawlers | 3% |
| Monitoring / uptime bots | 0% |
AI crawlers are mentioned by 28% of Travel & Tourism sites — the leading bot category. SEO / search indexing follows at 20%. Figures are percentages of all 100 Travel & Tourism sites including those with no robots.txt.
A notable share of Travel & Tourism sites maintain a mixed AI posture in robots.txt
| % of sites | |
|---|---|
| Uniform per-agent rules | 29% |
| Path-level mixed rules | 47% |
| Allow-only (no Disallow rules) | 2% |
| Mixed AI posture | 10% |
| Blanket Disallow: / | 0% |
10% of Travel & Tourism sites maintain a mixed AI posture — blocking some crawlers while allowing others. Path-level mixed rules leads at 47%. All figures are shares of all 100 Travel & Tourism sites surveyed.
AI crawlers are among the most-targeted agents in Travel & Tourism robots.txt
| Disallowed | Allowed (whitelisted) | |
|---|---|---|
| * | 71% | 42% |
| ChatGPT-User | 14% | 11% |
| PerplexityBot | 14% | 11% |
| GPTBot | 16% | 8% |
| AdsBot-Google | 13% | 9% |
| Googlebot | 10% | 9% |
| OAI-SearchBot | 11% | 7% |
| ClaudeBot | 11% | 5% |
| Bingbot | 7% | 8% |
| AdsBot-Google-Mobile | 7% | 7% |
| Mediapartners-Google | 8% | 6% |
| AhrefsBot | 7% | 5% |
| Google-Extended | 9% | 3% |
| Baiduspider | 7% | 3% |
| Yandex | 9% | 1% |
| psbot | 9% | — |
| AdIdxBot | 3% | 5% |
| NPBot | 8% | — |
| Applebot-Extended | 8% | — |
| PetalBot | 8% | — |
| anthropic-ai | 4% | 4% |
| Bytespider | 7% | — |
| ChatGPT-User/2.0 | 7% | — |
| Gemini-Deep-Research | 7% | — |
| Google-CloudVertexBot | 7% | — |
Values are percentages of all 100 Travel & Tourism sites surveyed. The wildcard (*) leads at 71% Disallow. Among named agents, GPTBot (16%) is the most-blocked; ChatGPT-User and PerplexityBot are tied at 14% Disallow.
Industry Cohort
Travel & Tourism leads the Travel & Hospitality cohort on AI-blocking policy
| WAF | Antibot | CAPTCHA | JavaScript | Rate Limit | TLS | robots.txt | Blocks AI | Tier | |
|---|---|---|---|---|---|---|---|---|---|
| Airlines | 76% | 24% | 11% | 51% | 27% | 22% | 69% | 9% | Tier 2 |
| Events Services | 83% | 17% | 21% | 41% | 26% | 12% | 65% | 3% | Tier 1 |
| Hospitality | 86% | 18% | 17% | 47% | 27% | 19% | 76% | 9% | Tier 2 |
| Recreational Facilities | 95% | 23% | 21% | 51% | 21% | 11% | 71% | 6% | Tier 1 |
| Restaurants | 91% | 28% | 19% | 57% | 41% | 15% | 50% | 5% | Tier 2 |
| Travel & Tourism | 81% | 27% | 8% | 55% | 31% | 26% | 78% | 21% | Tier 2 |
Travel & Tourism's 21% AI-blocking rate in robots.txt is the highest in the Travel & Hospitality cohort. WAF (81%) and JavaScript (55%) sit mid-table in the cohort on technical barriers.