· Blog
On October 23, 2026 at 14:14 UTC, our scheduled self-audit of generativemetrics.com returned AI Access Blocked: every required AI actor received HTTP 403 on its request for our homepage. We found out because we scan ourselves.
Our internal watchdog page went to a failing state and notified us. No dashboard we own raised an error. The hosting platform raised none either. The four required actors in that audit are OAI-SearchBot, Claude-SearchBot, Googlebot, and PerplexityBot. Each probe sent that crawler's own published User-Agent string, verbatim, requesting the homepage; our scanner identity is published separately at /gm-scanner.json. All four requests came back 403, and the scan re-confirmed the refusals before sealing the verdict.
What the sealed run records
The failing run is the first row of the table below: scan 1314ab86-07bb-4c4f-9b55-5f497e07d8f5, started 2026-10-23 14:14:45 UTC under protocol set gm-ai-consumer-compat/4.0.0, verdict AI Access Blocked / PARTIAL. Each of the four actor probes observed an HTTP 403 on the homepage request. The verdict is the audit's own execution state: a required actor was provably denied while the front door was reachable, confirmed by re-probe, and sealed.
A sealed bundle carries the request and response evidence behind every statement the report makes. Anyone can open the bundle at /verify and read the four 403 responses, request by request; the bundle's SHA-256 digest is recomputable on the same page, and a mismatch is reported as an integrity failure; the bundle is not served.
What it was not
It was not a rule anyone here set. On October 23, 2026, we verified both platforms in front of this site: on Cloudflare, Bot Protection was INACTIVE and the AI crawler categories were set to Allow; on the web host, no rule of ours denied anything, and none of our IP addresses appear in any deny list on either platform.
What happened next
At 20:15 UTC the same day, the next scheduled run passed. Then 08:15, 14:20, and 20:25 UTC on October 24, and 02:30 UTC on October 25 — five consecutive runs, all PASS. We changed nothing on the site between the failing run and the passing runs. A replayed burst of 13 crawler identities, sent from our side after the window, returned HTTP 200 for every request. The refusal self-lifted. We only knew because we scan ourselves every six hours.
What we believe happened, and what we cannot prove
The evidence points at the hosting platform's automatic mitigation layer acting on its own judgment. Our host records such events in its own dashboard; on October 23 those records showed mitigation activity against other traffic, and none of it involved our IP addresses. The boundary applies in both directions: a scan records what one request observed, not why the server behaved that way — so we say where the evidence points, not what is proven.
We are not naming the platform in this post: a scan cannot attribute motive, and the record above does not depend on the name. What is proven is the shape of the problem: the refusal was episodic — blocked once, then gone — and the switch that would prevent a repeat on our current plan is not ours. The recorded levers are the hosting paid tier's bypass (about $20 per month) or moving this site's origin. We have chosen neither, and our reasoning is on the record: we cannot stop the platform's judgment, but the six-hour self-audit catches it the day it happens and publishes what it finds. The paid bypass stays on the table; nothing in this post promises it.
What one episode can and cannot tell you
One episode is not a rate, and five passing runs are not a trend that retires the risk — the self-audit runs every six hours, and it will run again after this post is published. Nothing here speaks to citations, rankings, or outcomes. A PASS is an execution state, not a certificate about the future.
The checkable record
Every run below carries a SHA-256 digest anyone can recompute at /verify. The failing run is first; every row after it is a passing run of the same audit on the same site, with nothing changed on the site in between.
| Scan | Started (UTC) | Verdict | Bundle SHA-256 |
|---|---|---|---|
1314ab86-07bb-4c4f-9b55-5f497e07d8f5 | 2026-10-23 14:14:45 UTC | AI Access Blocked / PARTIAL | 2213affe3d1d293551b840e9d55fa311e36d2d90215405a3c0bd5b6364161d82 |
110c60b7-abb9-498a-b5e1-a9b39d9a4fe4 | 2026-10-23 20:15:15 UTC | PASS / COMPLETE | 603e8596a97e32aef3f45af3141cf1d18392a949e855805b4b512f180325b1b9 |
7b180e93-e9a7-4d07-bb15-d3f4fb8a39fe | 2026-10-24 08:15:16 UTC | PASS / COMPLETE | 4c74176f0bd51d79ab0d93624891c7ff3c0cf73047489b8f5d1f3afd0906d2a1 |
e5b4a0f2-3991-46ff-8126-fb5f956777f0 | 2026-10-24 14:20:16 UTC | PASS / COMPLETE | 25acdeba60a5bd9ab9f5be8e7591a86538f8ee313131f143d132d07e9d20afc4 |
12a690c3-9aab-4d9d-8a1b-499ed13e1f2d | 2026-10-24 20:25:13 UTC | PASS / COMPLETE | 56eddab25577825947ae005054ebd297d103a53dfe3683375ab03a6769b93a68 |
94fc0d3d-2dc2-4ff5-acf8-b3cd5a9502bb | 2026-10-25 02:30:19 UTC | PASS / COMPLETE | 864b3c6d7dd6959c32cedf33b554da68f17c4d227b96f8312aeb330a4f3ae1d3 |
Why we publish this
These failures are silent: an AI system that cannot read a site raises no error, and nothing tells its owner. For one sealed day, that was our site. The audit said so before any human here knew, and the record above is complete — the refusal and the recovery, both sealed.
This is the second time we have audited ourselves in public; the first record is the September 16 self-audit and its two published before/after pairs. If your tracker already shows you a zero, the Zero Autopsy page explains what our check can and cannot settle about it. Otherwise, the single-page check is free, needs no card, and takes about a minute: paste a URL, and the report either hands you a receipt or shows you the exact request where the page went silent. See a real sample report first if you want to know what you would get.