paypal.com: what it tells AI crawlers

On 28 October 2026, paypal.com's robots.txt allowed all of GPTBot, OAI-SearchBot, ClaudeBot, Claude-SearchBot, Google-Extended, PerplexityBot and CCBot; it also published llms.txt.

Last verified 2026-10-29 03:59 UTC (daily run of 2026-10-28). Proof for that day.

Panel

top 1k (Tranco)

robots.txt

ok (HTTP 200) · https://www.paypal.com/robots.txt
unchanged since 2026-10-26 · sha256 9c2f2f57e870e9b8… · view as recorded

The * group

allows applies to every agent without its own group

Per AI bot, 2026-10-28

Other signals

llms.txt: "no H1 title", 40,103 bytes, 152 links.

robots.txt as recorded sha256 f315cfff6a1ba990…

### BEGIN FILE ###

# PayPal robots.txt file 

User-agent: *
Disallow: /cgibin/
Disallow: /il/cart/
Disallow: /*?cmd=_pce*
Disallow: /row/
Disallow: /xclick-auction*
Disallow: /affil/
Disallow: /*?cmd=_flow*
Disallow: /*?cmd=_mobile-activate-outside
Disallow: /*?SESSION*
Disallow: /*?cmd=_s-xclick*
Disallow: /subscriptions/
Disallow: /ireceipt/get/
Disallow: /ireceipt/get?
Disallow: /getCallUsInfoData/
Disallow: /*?action=callus
Disallow: /loadHelpcenterDecouplePage
Disallow: /limited-release/
Disallow: /files/developer/
Disallow: /*?content_ID=developer
Disallow: /ebook/
Disallow: /IntegrationCenter/
Disallow: /limited-release
Disallow: /ebook
Disallow: /IntegrationCenter
Disallow: /ece/
Disallow: /webscr/
Disallow: /*?cmd=_xclick*
Disallow: /*?cmd=_cart*
Disallow: /*?cmd=_gxo-upgrade/
Disallow: /cms_content/
Disallow: /affil/
Disallow: /*?cmd=_donations*
Disallow: /*?cmd=_oe-gift-certificate*
Disallow: /refer/
Disallow: /cart?*
Disallow: /signin/inject/
Disallow: /_prq/
Disallow: /PWD/
Disallow: /mobile/checkout
Disallow: /webapps/checkout
Disallow: /webapps/hermes
Disallow: /webapps/aries
Disallow: /webapps/xo/html/cookiecheck.html
Disallow: /webapps/xoonboarding/*
Disallow: /agreements/approve
Disallow: /mobile/agreements
Disallow: /checkoutnow/
Disallow: /incontext
Disallow: /helios/
Disallow: /xorouter/
Disallow: /auth/verifychallenge/
Disallow: /signin?expId=confirmEmail
Disallow: /signin?expId=confirmEmail*
Disallow: /?expId=confirmEmail*
Disallow: /*?cmd=_pay-inv
Disallow: /affil/pal
Disallow: /refer/pal
Disallow: /pools/campaign/*
Disallow: /invoice/p/*
Disallow: /pools/c/*
Disallow: /claim-money?*
Disallow: /hub?category=*
Disallow: /fundraiser/charity/*
Disallow: /auth/createchallenge
Disallow: /graphql?
Disallow: /muse/identity/v2/identity.js
Disallow: /sdk/js
Disallow: /smart/button
Disallow: /smart/buttons
Disallow: /tagmanager/containers/xo
Disallow: /tagmanager/pptm.js
Disallow: /xoplatform/logger/api/logger
Disallow: /merchantapps/
Disallow: /clickthru/
Disallow: /invoice/payerView/*
Disallow: /invoice/payerView/attachments/*
Disallow: /invoice/estimate/buyerView/attachments/*
Disallow: /invoice/est/*
Disallow: /invoice/estimate/buyerView/*
Disallow: /invoice/p/*
Disallow: /pay/*
Disallow: /*?*payRequest=*
Disallow: /*?*cgi-bin=*
Disallow: /*?*onboardData=*
Disallow: /*?*signUpRequest=*
Disallow: /*?*guestLogin=*
Disallow: /*?*unptid=*
Disallow: /*?*tpcid=*
Disallow: /*?*requestmoney=*

Sitemap: https://www.paypal.com/paypal-sitemap-index.xml

robots.txt versions

Timeline of changes

Reconstructed history (Common Crawl)

From Common Crawl's robots.txt captures: what CCBot was served, one crawl per quarter. A separate series from the daily observations above; a 403 here means Common Crawl was refused, not this ledger.

Evidence

Every daily observation of paypal.com is a leaf in that day's Merkle tree. Proof of the robots.txt line for 2026-10-28: audit path (JSON), day root and OpenTimestamps proof (pending (4 calendars)).

API: https://infrarabbit.com/crawlers/api/v1/policy/paypal.com