---
title: "Perplexity Citation Audit: Check Visibility and Crawl Access"
description: "How to check whether Perplexity actually surfaces your brand — and why the audit has to include raw server logs, not just prompt sampling."
answer_summary: "How to check whether Perplexity actually surfaces your brand — and why the audit has to include raw server logs, not just prompt sampling."
canonical: "https://nqz.ai/blog/geo-perplexity-citation-audit-how-to-evaluate-source-visibility"
published_at: "2026-07-18T09:15:17.131Z"
updated_at: "2026-09-10T12:40:12.319Z"
author: "nqzai Editorial Team"
category: "GEO"
tags: ["perplexity","geo","aeo","ai-search","citation-audit","server-logs","generative-engine-optimization"]
image: "https://nqz.ai/blog/covers/geo-perplexity-citation-audit-how-to-evaluate-source-visibility.webp"
---

# Perplexity Citation Audit: Check Visibility and Crawl Access

A Perplexity Citation Audit is the practice of measuring, with evidence rather than assumption, whether and how a brand's pages are surfaced as sources in Perplexity's answers — and separately, whether Perplexity's crawlers are actually accessing those pages the way its own documentation says they will. Those are two different claims. The first is about visibility in the output. The second is about honesty in the input. A brand can be well-cited and still have no idea whether its robots.txt is being honored, and a brand can have a compliant robots.txt and still get zero citations. Conflating the two is the most common mistake in GEO content about this topic, and it's why an audit that only samples prompts and counts links is an incomplete audit.

## Quick Answer

- If you're focused on verifying the real user experience of citations → use manual prompt sampling, because it reflects the actual answer and sources a user sees in the Perplexity app.
- If you need scalable, reproducible citation data across many queries → use the Sonar API citation pull, because it returns a structured citations array and search_results object for high-volume, timestamped pulls.
- If you need ground truth on whether Perplexity's crawlers (declared or undeclared) actually hit your origin and honor robots.txt → perform server-log crawler verification, because it is the only method that tells you what happened on your own domain.
- If you want to measure whether cited pages convert into actual visits from Perplexity → run referral traffic analysis, because it isolates Perplexity as a referrer in your analytics to track click-throughs.
- If you need to benchmark your citation gaps against documented industry-wide patterns → consult third-party citation-pattern research, because large-sample studies describe the population and can highlight systematic sourcing tendencies.

## Why the log question isn't paranoia

In August 2025, Cloudflare published research alleging that Perplexity used undeclared, "stealth" crawlers — a generic Chrome/macOS browser signature — to keep retrieving content from domains that had explicitly blocked Perplexity's declared bots, including newly registered, non-public test domains with a robots.txt disallowing everything. Cloudflare said it observed roughly 20-25 million daily requests from Perplexity's declared user agents alongside 3-6 million daily requests it attributed to the undeclared crawler, spread across tens of thousands of domains, and that the pattern included rotating IP addresses and ASNs after a block was applied. Cloudflare contrasted this with ChatGPT-User, which it said "fetched the robots file and stopped crawling when it was disallowed" in the same test ([Cloudflare, "Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives," Aug. 4, 2025](https://blog.cloudflare.com/perplexity-is-using-stealth-undeclared-crawlers-to-evade-website-no-crawl-directives/)).

Perplexity disputed the finding directly and specifically. In its own post the next day, it said Cloudflare had misattributed traffic — arguing that a large share of the flagged requests came from a third-party cloud-browser service Perplexity uses occasionally, not from Perplexity's own infrastructure — and reframed the underlying dispute as philosophical: a user-triggered fetch executed on a person's explicit request, it argued, is not the same category of activity as unsolicited bulk crawling, and shouldn't be judged by the same robots.txt norms ([Perplexity, "Agents or Bots? Making Sense of AI on the Open Web," Aug. 5, 2025](https://www.perplexity.ai/hub/blog/agents-or-bots-making-sense-of-ai-on-the-open-web)). A Perplexity spokesperson separately told TechCrunch the Cloudflare post was a "sales pitch" and that the specific bot named in the report "isn't even ours" ([TechCrunch, "Perplexity accused of scraping websites that explicitly blocked AI scraping," Aug. 4, 2025](https://techcrunch.com/2025/08/04/perplexity-accused-of-scraping-websites-that-explicitly-blocked-ai-scraping/)). Cloudflare, for its part, followed through: it de-listed Perplexity's crawler from its verified-bot program and added heuristics to its managed rules to block the pattern it had flagged.

Neither side's account is independently verifiable from outside — that's exactly the point. It's an unresolved, contested claim between the crawler operator and a major CDN, not a settled fact either way, and it's the reason a citation audit that trusts self-reported compliance is trusting one party's account of a dispute the other party actively contests. If your domain sits behind Cloudflare or any WAF, the only way to know what actually happened on *your* origin is to read *your* logs.

For context, Perplexity's own documentation describes two separate, declared agents: **PerplexityBot**, which proactively indexes pages for search and is documented as respecting robots.txt, and **Perplexity-User**, which fetches a specific page in real time when a live user's question requires it, and which Perplexity's docs describe as generally not honoring robots.txt because a human explicitly triggered the request ([Perplexity, "Perplexity Crawlers,"](https://docs.perplexity.ai/docs/resources/perplexity-crawlers)). That distinction — proactive indexing vs. user-triggered fetch — is legitimate and matters for how you read your logs: a hit from Perplexity-User on a robots.txt-disallowed page isn't necessarily evidence of the "stealth" behavior Cloudflare described; it may be exactly the documented, declared behavior working as designed. The audit has to be able to tell the difference.

## What an audit actually measures


**Direct answer:** An audit worth the name checks four separable things: whether Perplexity's answers cite you, whether the citation reflects your actual content accurately, whether Perplexity's declared crawlers can reach the pages you want indexed, and whether traffic hitting your origin under Perplexity's name is coming from where it claims to.


| Audit layer | What it checks | Method | Confidence level | Main limitation |
|---|---|---|---|---|
| Manual prompt sampling | Whether specific target queries surface your domain in the answer's source panel | Run a representative query set directly in the Perplexity app/web UI, log citations shown | Medium — reflects real user experience | Small sample, non-reproducible across sessions, no API trail |
| Sonar API citation pull | Same as above, at scale and reproducibly | Query Perplexity's Sonar API and read the `citations` / `search_results` fields returned with each response | High for volume, medium for representativeness | API results can differ from the consumer app's retrieval configuration ([Sonar API features](https://docs.perplexity.ai/docs/sonar/features)) |
| Server-log crawler verification | Whether declared/undeclared bots are actually hitting your origin, and whether blocks are honored | Filter raw access logs by declared PerplexityBot/Perplexity-User user-agent strings, cross-check against Perplexity's published IP ranges, and separately flag anomalous non-declared traffic patterns | High — this is ground truth for your own domain | Only tells you what happened on your origin, not why you were or weren't cited |
| Referral traffic analysis | Whether cited pages convert citations into actual visits | Isolate Perplexity as a referrer/source in your analytics | High for what it measures | Citation without a click is invisible here; undercounts brand-awareness value |
| Third-party citation-pattern research | Whether your sourcing gaps match documented platform-wide patterns | Compare your findings against independent large-sample studies | Medium — describes the population, not your specific brand | Aggregate studies can't tell you why *your* domain specifically is or isn't cited |

## The step-by-step process

1. **Define a representative query set.** Twenty to fifty prompts that mirror how your actual buyers phrase questions in Perplexity — not just your target keywords rewritten as questions. Pull real phrasing from your own search-console query data and support transcripts where possible.

2. **Run the query set through the Perplexity web app and record what you see.** For each answer, log the sources panel exactly as shown: domain, specific URL, citation position, and the snippet of the answer that the citation supports. This is what a user actually experiences, and it's the baseline the rest of the audit is checked against.

3. **Repeat the same query set programmatically via the Sonar API.** Perplexity's API returns a `citations` array and a `search_results` object with each response, giving you a structured, timestamped, re-runnable version of step 2 ([Sonar API features](https://docs.perplexity.ai/docs/sonar/features)). Store results with the date — citation sets shift as Perplexity's index and retrieval config change.

4. **Map cited URLs against your own site inventory.** For every citation you did get, note which specific page was cited, how recently it was updated, and whether it's a page you'd have chosen to represent that topic. For every query where a competitor was cited instead, pull their cited URL and compare structure, specificity, and freshness against yours.

5. **Pull your raw server logs and filter for Perplexity's declared user agents.** Cross-reference the requesting IPs against Perplexity's published ranges for PerplexityBot and Perplexity-User (published as JSON endpoints under perplexity.com) — a user-agent string alone is trivially spoofable, so the IP/ASN cross-check is the step that actually verifies identity rather than assuming it.

6. **Separately flag non-declared traffic that resembles bot behavior** — high-frequency sequential page requests, generic browser user-agents from data-center ASNs, request patterns that don't match a human session. This is the layer Cloudflare's report was built on; you don't need Cloudflare's infrastructure to look for the same signal in your own logs.

7. **Check what your robots.txt currently permits, deliberately, for each agent.** Confirm your directives for PerplexityBot and Perplexity-User separately reflect an actual decision rather than an inherited default — remember Perplexity's own documentation states Perplexity-User is designed to fetch live pages on a user's behalf regardless of the disallow rule for bulk crawling, so a hit there is not automatically a violation.

8. **Run a controlled honeypot check if the stakes justify it.** A single unlinked test page with a restrictive robots.txt, checked periodically against whether Perplexity's answers can describe its content, is a low-cost way to independently verify crawl-block compliance rather than relying on either company's public claims. This mirrors the exact test Cloudflare says it used.

9. **Establish a cadence and diff against baseline.** Citation sets, crawler behavior, and even documented policy can change without notice — Perplexity's own robots.txt guidance has been revised more than once in the past two years. Re-run steps 2-6 on a fixed schedule (monthly is reasonable for an active content push) and track the delta, not just the snapshot.

## What this doesn't guarantee

**Direct answer:** An audit is diagnostic, not corrective. Running one, however rigorously, does not guarantee any of the following:

- **It won't make Perplexity cite you.** The audit tells you where the gaps are; closing them (better structure, more current data, deeper topical coverage) is separate work with no guaranteed payoff, because retrieval and ranking inside Perplexity's system aren't published or stable.
- **It can't resolve the Cloudflare/Perplexity dispute for your domain.** Your logs can tell you what hit your own origin. They can't adjudicate whose broader characterization of Perplexity's crawling practices is correct — that's an ongoing, contested claim between two companies, not a fact you can settle with one log pull.
- **A clean log doesn't mean permanent compliance.** Crawler behavior, IP ranges, and declared policy can all change. A verification done today is a snapshot, not a standing certification.
- **Citation volume isn't validated ranking or traffic value.** Independent research shows Perplexity cites far more sources per answer than ChatGPT does — one large analysis of Q3 2025 answers found Perplexity averaging roughly 22 citations per answer versus ChatGPT's 8 ([Qwairy, "Perplexity vs ChatGPT: AI Citation Study (Q3 2025)"](https://www.qwairy.co/blog/provider-citation-behavior-q3-2025)) — so a citation count that looks impressive in isolation may just reflect Perplexity's citation-dense answer style, not unusual brand strength.
- **It can't fix an inaccurate citation.** If Perplexity summarizes your content incorrectly, the audit surfaces the error; it doesn't correct it. That requires using Perplexity's own feedback mechanism, and there's no published guarantee of a fix or a timeline.

## Where nqzai fits


**Direct answer:** nqzai runs this kind of audit as part of its AI-search visibility work — sampling a brand's real query set against live AI-answer engines, structuring the citation results against the brand's own URL inventory, and pairing that with an honest read of whether the brand's own logs and directives are actually configured the way the brand assumes, rather than reporting citation counts in isolation and calling it done.


## FAQ

**Direct answer:** **Does Perplexity use my content to train its underlying AI models when it crawls my site?**
No, according to Perplexity's own documentation — both PerplexityBot and Perplexity-User are described as not being used for foundation-model training; PerplexityBot is described as an indexing crawler and Perplexity-User as a real-time, user-triggered fetch ([Perplexity Crawlers docs](https://docs.perplexity.ai/docs/resources/perplexity-crawlers)).

**My robots.txt blocks PerplexityBot. Will that stop me from being cited?**
It should stop proactive indexing, but Perplexity's documentation states Perplexity-User — the agent that fetches a page live in response to a specific question — is designed to generally act regardless of that disallow rule, since a human explicitly asked for it. Blocking PerplexityBot alone doesn't guarantee your content is invisible to Perplexity's answers; verify against your actual logs rather than assuming the block worked as intended.

**Is the Cloudflare/Perplexity dispute resolved?**
Not publicly. Cloudflare de-listed Perplexity's crawler and added blocking rules; Perplexity disputed the traffic attribution and has not retracted its rebuttal. Treat both companies' public statements as advocacy for their own position, not neutral fact, and verify what happens on your own domain independently.

**How is Perplexity's citation behavior different from ChatGPT's or Google's AI Overviews?**
Independent large-sample research shows real differences in sourcing. One analysis of over 680 million citations found Reddit is Perplexity's most-cited domain (roughly 6.6% of citations) while ChatGPT leans on Wikipedia (roughly 7.8%) ([Profound, "AI Platform Citation Patterns"](https://www.tryprofound.com/blog/ai-platform-citation-patterns)); a separate academic study of over 366,000 citations found Perplexity's news citations concentrate on a small number of outlets, with BBC appearing prominently ([Kai-Cheng Yang, "News Source Citing Patterns in AI Search Systems," arXiv, July 2025](https://arxiv.org/abs/2507.05301)). Optimizing for one engine's citation style doesn't transfer cleanly to another.

**How often should I re-run a citation audit?**
Monthly is reasonable for a brand actively publishing content aimed at AI-search visibility; quarterly is a reasonable floor otherwise. Citation results and even documented crawler policy have both changed materially within months in the past, so a one-time audit has a short shelf life.

**What do I do if Perplexity cites my brand inaccurately?**
Perplexity supports in-product feedback on individual answers. Document the query, the exact citation, and the inaccuracy, and submit it through that mechanism — there's no published SLA for a correction, so treat it as a report, not a guaranteed fix.