Do AI crawlers follow QR code redirects? What agencies need to know

Type a brand name into ChatGPT search or Perplexity and you get an answer instantly, but the honest question behind that instinct is different: does the crawler behind that answer ever actually reach the page your QR code was printed to send people to? A QR code is not itself a piece of content. It is a physical-to-URL translation layer that resolves through one or more HTTP redirects before a browser, or a bot, ever sees a landing page. Agencies have spent years optimising that landing page for Google. Far fewer have asked whether the redirect chain in front of it is even visible to GPTBot, ClaudeBot, PerplexityBot, or the retrieval bots that answer a live ChatGPT or Perplexity query, which is the layer that decides whether a client's campaign shows up when their own customers ask an AI assistant about them.

Why this question is worth asking in 2026

Bot traffic is no longer a rounding error next to human visitors. Cloudflare's Radar data put automated requests at 57.5 per cent of HTML traffic across its network in June 2026, the first time bots have outnumbered humans in that measurement. A year earlier, only 22 per cent of crawler activity Cloudflare classified was for AI training purposes; by mid-2026 that had risen to 52 per cent, with a further, fast-growing slice for real-time AI search and agent fetches. Fastly's independent numbers point the same direction: AI request volume on its network grew roughly 30 per cent between January and May 2026 alone, about 6.5 times faster than human traffic growth over the same months.

None of that traffic is scanning a QR code, since a QR code cannot be crawled, only clicked. All of it is crawling URLs. So the real question for an agency is not "can an AI read a QR code" but "does the redirect chain a QR code triggers land somewhere these crawlers can actually reach, parse and eventually cite." That is a solvable technical question, and most agencies have never checked the answer for their own campaigns.

What an AI crawler actually does with a redirect

The three big AI labs each run more than one crawler, and the split matters. OpenAI operates GPTBot, which gathers training data; OAI-SearchBot, which indexes pages so they can surface in ChatGPT's search results; and ChatGPT-User, which fires in real time when someone asks ChatGPT a live question and it goes to fetch a page. Anthropic mirrors this with ClaudeBot for training, Claude-SearchBot for indexing, and Claude-User for live, user-triggered fetches. Perplexity documents PerplexityBot as its indexing crawler (explicitly not used to train its underlying models) and Perplexity-User as the real-time fetcher tied to an actual query. Google folds AI Overviews into ordinary Googlebot crawling and reserves a separate token, Google-Extended, purely for whether already-crawled content may be used to train or ground Gemini and Vertex AI. Blocking Google-Extended does not remove a page from Search or from AI Overviews; only blocking Googlebot itself does that.

None of them render JavaScript

Vercel's own network-log analysis of AI crawler behaviour found that GPTBot and ClaudeBot do fetch JavaScript files, in roughly 12 and 24 per cent of requests respectively, but showed no evidence either one executes them. That single fact rules out a whole category of campaign landing pages: anything that resolves its final content client-side, behind a JavaScript redirect, or via a script that swaps content in after load, is functionally blank to a training or indexing crawler. A page that looks identical to a human and a crawler in a browser can be two completely different pages to GPTBot, which only ever sees the raw HTML response.

Hop limits: one vendor publishes a number, three do not

Google is unusually specific here: Googlebot follows up to ten redirects in a chain, but Google's own developer documentation recommends redirecting straight to the final destination and, where that is not possible, keeping a chain to no more than three or four hops. Neither OpenAI, Anthropic nor Perplexity publishes a hop limit for GPTBot, ClaudeBot or PerplexityBot. That absence gets papered over constantly: plenty of SEO blogs quote a specific number of hops these bots supposedly tolerate, but none of it traces back to a vendor source, and this piece will not repeat an invented figure. The honest position is that an agency is optimising against an unpublished, and quite possibly stricter, tolerance than the generous ten hops Google gives, which is reason enough to keep a chain as short as it can possibly be.

301 or 302, and why it changes what gets remembered

The two status codes carry genuinely different meanings under the HTTP specification (RFC 9110), not just SEO folklore. A 301 tells any client the move is permanent, and Google's own documentation confirms its indexing pipeline treats a 301 (or 308) as a signal that the destination should become canonical, passing the original URL's standing to the new one. A 302 (or 307) signals a temporary move, and Google's pipeline follows it every time but keeps the original URL as authoritative rather than the destination. None of the three AI labs document whether their crawlers cache a 301 target and skip re-verifying it later, versus re-walking a 302 chain from scratch each time. That is a reasonable inference from the RFC and Google's public behaviour, not a documented fact for GPTBot, ClaudeBot or PerplexityBot. What follows from the parts that are documented: a QR code pointed at a stable, evergreen destination is a legitimate case for a 301, and dynamic QR platforms that let an agency change the destination later without reprinting should still resolve through as clean and short a redirect as the platform allows, whichever status code it uses.

Where the hops actually pile up on a real campaign

A single, well-built dynamic QR redirect is one hop: the code resolves straight to the platform's short domain, which appends any tracking parameters in the same response and sends the visitor on to the final landing page. That is the shape ScanKit's redirects are built around, and it is very unlikely to trouble any crawler, published hop limit or not. The chain gets long through habit, not necessity: an agency reuses a bit.ly-style shortener it already has for social posts and points that at the QR platform's link instead of the client's page directly, the client's own CMS adds a redirect of its own when a page gets moved, and a separate tool bolts on UTM parameters through yet another hop. Each addition is invisible to a human on a phone, since a mobile browser resolves the whole chain in well under a second, but not to a crawler working through an unpublished, possibly tight, hop budget. Three or four stacked redirects is already inside the zone Google calls risky; on AI crawlers it is simply unmeasured territory. A QR platform and a URL shortener solve different problems, and stacking one on top of the other for the same link is the single most common way an agency adds hops it does not need.

1. The camera scan of the printed QR code.
2. The QR platform's redirect domain: one clean hop straight to the destination.
3. An agency shortener or a client CMS redirect stacked on top: an avoidable extra hop, flagged here because it is the easiest mistake to fix.
4. The final landing page, reached and read correctly by a crawler.

llms.txt: a tidy idea, not yet a lever

llms.txt is a proposed convention, published by Jeremy Howard of Answer.AI in September 2024, that asks a site to list its most important pages in a plain-text file for an AI system to read. It has no backing from a standards body, and the canonical llms.txt site itself describes it as a proposal open for community input rather than an adopted standard. A study of roughly 300,000 domains by SE Ranking, published in November 2025, found no measurable correlation between having an llms.txt file and how often a domain got cited by AI systems, and removing the variable from their predictive model actually improved its accuracy. No major AI lab has published documentation committing its crawlers to read a third-party llms.txt file at inference time. None of that makes llms.txt harmful, and a tidy index of a client's key pages costs little to produce, but an agency should not sell it as something that measurably improves AI visibility. The evidence available today says it does not, at least not yet.

The robots.txt tokens that actually matter

Every AI lab documents its own crawler user-agent strings, and these are the actual levers, not llms.txt.

• OpenAI: GPTBot (training), OAI-SearchBot (ChatGPT search indexing), ChatGPT-User (live, user-triggered fetch; OpenAI's own documentation notes robots.txt rules may not apply to it the way they do to GPTBot).
• Anthropic: ClaudeBot (training), Claude-SearchBot (search indexing), Claude-User (live fetch, same real-time caveat), plus a non-standard Crawl-delay directive Anthropic supports for ClaudeBot.
• Perplexity: PerplexityBot (indexing; Perplexity recommends allowing it to appear in its answers), Perplexity-User (live fetch, which generally ignores robots.txt since a human, not the crawler, initiated it).
• Google: ordinary Googlebot rules govern both Search and AI Overviews; Google-Extended only ever affects Gemini and Vertex AI training and grounding, never appearance in Search or AI Overviews.

Before a print run, it is worth opening the client's live robots.txt file and checking none of these tokens are blocked by an old, over-broad "disallow all bots" line inherited from a previous developer, since that single line silences a landing page for every AI system at once, however clean the redirect chain in front of it is.

Does the AI system know a QR code was involved at all

No, and it is worth being precise about why. Every crawler and retrieval bot described above fetches a destination URL. None of the documentation from OpenAI, Anthropic, Perplexity or Google mentions a QR code, a camera scan, or any physical medium, because none of them have a mechanism for knowing how a URL was reached, whether that was a QR scan, a typed address, or a click from another page. The QR code itself is, and always will be, invisible to an AI system by construction. What is visible, and what actually gets crawled and cited, is whatever URL the redirect chain resolves to, on exactly the same terms as if a person had reached it any other way. An agency does not need an AI system to "understand" a page came from a QR campaign; it needs the destination to be an ordinary, crawlable, well-built page, reached through a chain short and stable enough not to get in the way.

A pre-print checklist for AI-visible QR campaigns

Run through this before a campaign goes to print, not after a client asks why they cannot find their own promotion in ChatGPT.

• Collapse the chain to one hop wherever possible: QR code straight to the platform's redirect domain, straight to the final page, with tracking parameters appended in that single response rather than a second redirect.
• If an agency shortener or a client CMS redirect is genuinely unavoidable on top of that, keep the total chain to two hops at most, since three or more is already past what Google itself calls safe and further still into territory no AI lab documents at all.
• Use a permanent redirect for a stable, evergreen destination, and remember a custom domain on the QR link does not change any of this crawler behaviour, but it does remove one third-party hop by putting the redirect on infrastructure the agency or client already controls.
• Confirm the final landing page renders its real content in the initial HTML response, not behind a client-side redirect or a script that swaps content in after load, since GPTBot and ClaudeBot fetch scripts without running them.
• Check the live robots.txt on the destination domain for GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, Claude-SearchBot and Claude-User, and remove any blanket bot-blocking line that predates the campaign.
• Treat llms.txt as optional tidiness, not a checkbox that moves AI citation, based on the evidence available today.
• Beyond crawlability, the destination page still has to earn a citation on its own merits, which is a content question: see what actually makes a QR landing page convert once a visitor, human or otherwise, has reached it.

Frequently asked questions

Do AI crawlers like GPTBot and PerplexityBot follow QR code redirects?

Yes. None of these crawlers know or care that a QR code was scanned; they simply request whatever URL they are given, following redirects the same way any HTTP client does, up to whatever hop tolerance they apply internally.

How many redirect hops can an AI crawler follow before it gives up?

Only Google publishes a number: Googlebot follows up to ten hops, with an official recommendation to keep a chain to three or four at most. OpenAI, Anthropic and Perplexity do not publish a hop limit for GPTBot, ClaudeBot or PerplexityBot, so treat their tolerance as unknown and design for the shortest possible chain rather than assume any specific figure quoted elsewhere.

Can ChatGPT or Perplexity read content behind a JavaScript redirect?

No. Network-log analysis shows GPTBot and ClaudeBot fetch JavaScript files but do not execute them, so a redirect or content swap that only happens client-side is invisible to these crawlers even though it works fine in a human's browser.

Should a QR code use a 301 or 302 redirect for AI search visibility?

Use a 301 for a stable, evergreen destination; it signals a permanent move and is the status code Google's own indexing pipeline treats as a canonicalisation cue. A 302 is the right choice only while a destination is genuinely temporary, since neither Google nor, so far as documented, any AI lab treats it as a signal to consolidate ranking or citation onto the new URL.

What is llms.txt, and does it help a QR campaign get cited by AI?

It is a proposed convention for listing a site's key pages in a plain-text file, with no standards-body backing and no vendor confirmation that any major AI crawler reads it at inference time. A study of around 300,000 domains found no measurable citation benefit from having one. It is harmless to add but should not be sold as something that improves AI visibility.

What share of web traffic is AI crawlers today?

By June 2026, Cloudflare Radar measured automated requests at 57.5 per cent of HTML traffic on its network, the first time bots outnumbered humans in that count, with AI-training-purpose crawling alone rising from 22 to 52 per cent of crawler activity over the preceding year. These figures move quickly, so treat any single percentage as a snapshot of its stated measurement window rather than a fixed constant.

Will blocking GPTBot in robots.txt hurt a QR campaign's visibility in ChatGPT?

Yes, directly. Blocking GPTBot stops OpenAI's training crawler, and blocking OAI-SearchBot removes a page from ChatGPT's search results (OpenAI notes roughly a day for that change to take effect). The Claude and Perplexity indexing bots need checking independently, since blocking one lab's crawler has no bearing on another's.

Does a custom domain on the QR redirect help AI crawlability?

Indirectly. A custom domain does not change how any crawler treats a redirect, but it typically removes a third-party hop from the chain by putting the redirect on infrastructure the agency or client already controls, which is one less hop for any crawler or hop-limit budget to work through.

Should agencies build QR landing pages differently for AI search than for classic Google SEO?

Mostly not differently, just more strictly. The redirect-chain hygiene, server-rendered HTML, and open robots.txt that already make a page reliably crawlable for Google are the same fundamentals AI crawlers need. The difference is tolerance: Google publishes generous limits and recovers gracefully from most mistakes; the AI labs publish none of that, so the same good practice has to be applied more strictly, with no published safety margin to fall back on.

The short version

A QR code is invisible to every AI crawler and retrieval bot in existence, and it always will be, because none of them have any way to know how a URL was reached. What they do see, crawl and potentially cite is the destination the code's redirect chain resolves to, on the same terms as any other page on the web. GPTBot and ClaudeBot fetch JavaScript without running it, so a page that only renders client-side is functionally blank to them. Only Google publishes a hop-limit number; the AI labs do not, which means the safest move is collapsing a redirect chain to one hop rather than assuming any specific tolerance. A 301 is the right call for a stable destination; llms.txt is optional tidiness with no measured citation benefit yet; and the robots.txt tokens for GPTBot, ClaudeBot, PerplexityBot and their real-time counterparts are the actual levers worth checking on a client's domain before the next print run, not after a client asks why their own campaign cannot be found.