Omega8.cc: A Sign Is Not a Door

Someone told me this week, correctly, that ClaudeBot and GPTBot respect robots.txt, so there is no need to block them by other means, and that the really bad bots disguise as Chrome anyway, so a user-agent is useless; watch behaviour, get a WAF. Every fact in that is right and the conclusion is still wrong, and the gap between the two is the story of why the old ways of guarding a Drupal or Backdrop site have quietly stopped working. Not one of the seven stock robots.txt files a Drupal or Backdrop site ships names a single AI agent, and on a core past its end of life that file will never change again; one vendor honours your notice for its crawler and waives it for its assistant in the same document; a hand-kept blocklist goes stale in a month, and a WAF only ever refuses what someone already knew how to describe. What holds is a server which says no cheaply for what it can recognise, and judges the rest by what it does today.