AEO Insights·9 min read

AI Crawler Policies of 8 Korean Metropolitan Governments — From Fully Open to Path Whitelists

We checked the robots.txt files and root-URL responses of the homepages of Korea's 8 special/metropolitan city governments. Policies toward 17 AI crawlers fell into fully open, path whitelist, named-bot block, full block, and unreadable. We also updated our own diagnostic logic, which keeps pace with a fast-changing environment.

D

Dohak Kim

Marketing Architect · Ph.D. in International Marketing (UIBE)

Published

2026-10-23

AI Crawler Policies of 8 Korean Metropolitan Governments — From Fully Open to Path Whitelists

Summary

The AI crawler policy across 8 metropolitan governments was not one policy. Fully open, "Disallow: /" with per-path Allow whitelists, rules blocking one named AI bot, a full block, and sites whose robots.txt could not be read. No rankings here — just the structural picture and what to improve.

Why Metropolitan Government Homepages

In an era when citizens ask AI "where do I file a move-in report?", a government homepage is the source of official information. Whether AI can read that source depends on robots.txt and how the first page responds. We checked all 8 special and metropolitan city governments (Seoul, Busan, Daegu, Incheon, Gwangju, Daejeon, Ulsan, Sejong). The 8 are not a sample; they are the whole of that administrative category. This article does not rank anyone. It covers only the structural picture visible in public responses and what to improve. Measured on October 20, 2026; settings may have changed since.

AI Crawler Policy Fell Into Five Types

We classified policy against 17 AI crawlers (training, search, user-request, and control tokens), which we covered in our earlier post.

Policy TypeCountDescription
Fully open2No restrictions on any of the 17 AI crawlers
Path whitelist2Disallow: / followed by Allow for permitted paths only
Named-bot block1One specific AI bot (GPTBot) explicitly blocked
Full block1Disallow: / under User-agent: * with no allow rules; 16 of 17 blocked
Unreadable2robots.txt returns 401 (auth required) or 404 (no file)

The first finding is that policy has not converged on one approach. That does not say which is right; it says intent and inertia have accumulated differently at each institution. A full block is the strongest form of policy here, but public responses alone cannot tell whether it was a deliberate decision or a leftover security setting. So this article does not judge whether any policy is right or wrong.

A Whitelist Is Not a Full Block — Where We Updated Our Tool for a New Pattern

Two sites looked like this.

User-agent: * / Disallow: / / Allow: /main / Allow: /news / Allow: /citizen ...

The standard (RFC 9309) prefers the longest matching rule, so this opens only the allowed paths rather than blocking everything. The earlier logic of our diagnostic tool (AEGIS Insight) judged this as "all 17 AI crawlers fully blocked." As the kinds of AI crawlers and the ways sites use robots.txt change quickly, this was a gap we missed when we first met the public-sector whitelist pattern at scale. We found it while checking government sites, rebuilt the logic around longest-match, and made it distinguish fully open, partially open, and fully blocked. Keeping measurement from falling behind the times, and disclosing what we missed rather than hiding it, is a principle of this series.

With a whitelist, the key check is whether paths for areas citizens often ask AI about — civil services, welfare, transport, tourism — are on the list.

When robots.txt Cannot Be Read

Two sites could not be judged at all. One returned 401 (authentication required) for the robots.txt request, and one had no file (404). A missing file means no restrictions under the standard, but the policy is undocumented, so intent is unknown. A 401 leaves crawlers unable to read the rules and needs its own check.

A Second Update — The Host After a Redirect

The site classified as a full block was first recorded as "robots.txt missing (404)." Its root address redirects to an authentication (SSO) server, and our tool looked for robots.txt on the host it was redirected to. The site's own policy was the opposite. We noticed the mismatch while writing, fixed the tool to check the host of the address the user entered first, and re-measured that institution. When a diagnostic's judgment cannot follow the variety of real-world structures, it can lead to wrong statements about a public body, so we fixed and re-measured as soon as we found it.

First Pages That Are Empty

Counting body words on the root URLs, two sites stood out.

ObservationDetail
JS redirect stubThe root response is a 6-word script that moves to the real front page (about 880 words) via JavaScript
SSO redirectThe root moves to an authentication address with a short response; 0 body words
Refusal by User-AgentOne site works for normal browsers but intermittently refused our diagnostic UA

This is the same structure as the "blank page for crawlers" problem in our prerendering post. People see a normal page, but crawlers that do not run JavaScript may never reach the body. Search grounding can compensate, so scores are less affected, but it is still the entrance to the information AI reads directly.

Five Improvements

#Improvement
1Decide the AI crawler policy deliberately and state it in robots.txt. Even when blocking, document the reason and scope
2If using a whitelist, check that paths for areas citizens ask about (civil services, welfare, transport, tourism) are on the allow list
3Do not return 401 or 403 for robots.txt; if absent, add a minimal file
4Provide a representative address the server answers directly. JS or SSO redirects can look blank to crawlers
5Periodically check that WAF and access rules do not unintentionally refuse search and AI crawler User-Agents

The Measurement Tool Keeps Updating

The AI search environment changes quickly. Crawler types multiply and sites configure themselves differently. If a measurement tool cannot keep up, it ends up scoring against outdated standards. We keep updating the judgment logic of the AEGIS platform for every case we meet in the field so it does not fall behind the times.

WhenUpdateTrigger
Sep 2026AI crawler judgment widened from 9 to 17 types (including live-search and user-request bots)A training-bot-centered list missed live-answer bots
Sep 2026Page speed switched from model estimate to PageSpeed measurementAn estimate was being used as if measured
Oct 2026Fixed shared-group and prefix errors in robots.txt judgment; 403 responses treated as collection failures, not missing elementsFound during checks
Oct 2026Whitelists (Disallow: / + per-path Allow) distinguished as partial access (RFC 9309)Government site checks
Oct 2026Check the host of the entered address first, not the post-redirect hostAn SSO redirect case

This list will keep growing. Updating the logic every time we meet a new pattern, and publishing the history, is how we believe a measurement tool avoids going out of date.

Limits of This Check

This is one set of public responses from a Korean environment on October 20, 2026. robots.txt can change at any time, and some sites respond differently depending on User-Agent or IP. The 8 are the whole of their category but we do not generalize statistically. We did not judge whether any policy is right.

Next

The next post covers the structure scores (SEO, AEO, GEO) for the same 8, schema and sitemap status, and what to watch for when reading scores. You can diagnose your own institution with AEGIS Insight.

Frequently Asked Questions

Q.Is this a ranking of local governments?

A.No. We do not publish rankings or score orderings. We cover only the structural picture observable in public responses and what to improve. Measurements are of public responses on October 20, 2026; settings may have changed since.

Q.Is blocking AI crawlers in robots.txt wrong?

A.No. Whether to block or open is an institutional policy decision. What this article checks is whether the setting matches the intent, and whether official information can be read when citizens ask AI.

Q.Does "Disallow: /" together with "Allow: /main" mean a full block?

A.No. The standard (RFC 9309) prefers the longest matching rule, so "Disallow: /" plus per-path Allow rules is a whitelist that opens only the allowed paths. Our diagnostic tool's earlier logic did not account for this pattern; we updated it to the standard behavior during this study.

Q.If robots.txt is missing (404), are AI crawlers blocked?

A.No. A missing file means no restrictions under the standard. But the policy is undocumented, so intent is unclear, and responses like 401 that crawlers cannot read are a separate problem.

Q.Why is a redirect-stub root URL a problem?

A.An address that reaches its body only through a JavaScript or login (SSO) redirect can look like an empty page to crawlers that do not execute them. It is fine for people but the first page AI reads may be blank.

How to Apply This — Step by Step

  1. 1

    Read your actual robots.txt

    Open domain/robots.txt and read the User-agent: * block and any AI-crawler-specific rules. Record response codes such as 401, 403, and 404 too.

  2. 2

    Classify your policy type

    Decide whether you are fully open, a path whitelist, blocking specific AI bots, or fully blocking, and confirm it is the intended policy.

  3. 3

    If a whitelist, check coverage of official-information paths

    If you use Disallow: / with per-path Allow, make sure the paths for areas citizens ask AI about — civil services, welfare, transport, tourism — are in the allow list.

  4. 4

    Check how the root URL responds

    Fetch the root with curl and see whether body sentences are present. If the body is reached only via JS redirect or SSO, provide a representative address the server answers directly.

  5. 5

    Test bot User-Agent handling

    Confirm that requests with a non-browser User-Agent are not refused (connection drops, 401). WAF rules can unintentionally block search and AI crawlers.

Government WebsitesPublic-sector AEOAI Crawlersrobots.txtMetropolitan GovernmentsAEOGEOMarketingPivotProjectAEGIS
🌐 Prefer to read this in Korean?한국어로 보기 →