What is Google-Site-Verification?
It fetches Search Console verification tokens when someone asks Google to verify ownership of a site.
A bot that fits none of the groups above, such as an ad review crawler.
Google says user-triggered fetchers generally ignore robots.txt because a user asked for the fetch.
Google-Site-Verification user agent
Google documents this user agent for Google-Site-Verification. Version numbers in it change over time, so match on the name, not the whole string.
Mozilla/5.0 (compatible; Google-Site-Verification/1.0)Should you block Google-Site-Verification?
It depends on what it does; read the operator’s page below.
How to block Google-Site-Verification in robots.txt
Google says Google-Site-Verification does not follow robots.txt, so a robots.txt rule won’t stop it. Block it at your server or firewall by user agent, and by IP if Google publishes its ranges.
How to verify a request is really Google-Site-Verification
Anyone can send any user agent, so the string alone proves nothing.
Google publishes the IP ranges Google-Site-Verification crawls from. A request that claims to be Google-Site-Verification from any other address is not Google-Site-Verification.
Or check by reverse DNS: look up the hostname of the request’s IP, confirm it ends in google.com, then look that hostname up again and confirm it points back to the same IP.
See when Google-Site-Verification reads your site
Bots don’t run JavaScript analytics, so a script tag never sees them. invisit records crawler reads on the server instead, through its server SDK or a Cloudflare Worker, and shows which bots read which pages, next to your visitors.
Checked against Google’s own documentation on . Something changed? Write to help@invisit.dev.