Quick answer: Add these two lines to your robots.txt and AhrefsBot will stop crawling your site within a day or two:
User-agent: AhrefsBot
Disallow: /That’s the simplest method and the one most people want. If you need a hard block (server returns 403 instead of relying on bot compliance), use .htaccess, Nginx, or a Cloudflare WAF rule — all the code is below. Blocking AhrefsBot does not affect your Google rankings — Ahrefs is a third-party SEO tool, completely separate from Googlebot.
Pick a blocking method (comparison)
| Method | Strength | Effort | Best for |
|---|---|---|---|
| robots.txt | Soft (relies on bot compliance — Ahrefs respects it) | 2 min | Anyone with FTP/cPanel access |
| .htaccess | Hard (server returns 403) | 5 min | Apache servers, shared hosting |
| Nginx config | Hard (server returns 403) | 5 min | VPS / dedicated servers |
| Cloudflare WAF | Hard (blocked at edge before request hits origin) | 3 min | Sites already on Cloudflare |
| IP-range firewall | Hardest (drops packets at OS level) | 10 min | When user-agent spoofing is a concern |
The right pick depends on whether you want a polite signal (“please don’t crawl”) or an enforced block (“server refuses every request from this bot”). For 95% of cases, robots.txt is enough — Ahrefs is a well-behaved crawler and respects it within a day or two.
Method 1: Block AhrefsBot via robots.txt (recommended)
The most common method. Add these lines to your robots.txt file at the root of your domain:
User-agent: AhrefsBot
Disallow: /If you only want to block AhrefsBot from specific directories (and let it crawl the rest):
User-agent: AhrefsBot
Disallow: /admin/
Disallow: /private/
Allow: /AhrefsBot reads robots.txt on every visit, so the rule takes effect within hours. If you don’t have a robots.txt file yet, use a free robots.txt generator to create one quickly.
Method 2: Block AhrefsBot via .htaccess (Apache)
If you want a hard block — the server returns 403 Forbidden instead of relying on the bot to honor robots.txt — add this to your .htaccess file:
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} AhrefsBot [NC]
RewriteRule .* - [F,L]The [NC] flag is case-insensitive matching. [F,L] means “Forbidden, Last rule” — return 403 and stop processing further rules. To block multiple SEO bots at once:
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (AhrefsBot|SemrushBot|MJ12bot|DotBot) [NC]
RewriteRule .* - [F,L]Method 3: Block AhrefsBot via Nginx
For Nginx servers, add this inside your server { } block:
if ($http_user_agent ~* "AhrefsBot") {
return 403;
}To block multiple SEO bots:
if ($http_user_agent ~* "(AhrefsBot|SemrushBot|MJ12bot|DotBot)") {
return 403;
}Reload Nginx to apply: sudo nginx -s reload.
Method 4: Block AhrefsBot via Cloudflare WAF
If your site is already on Cloudflare, blocking at the edge is the cleanest option — the request never hits your origin server, saving bandwidth and CPU.
- Cloudflare dashboard → Security → WAF → Custom rules
- Click Create rule
- Field:
User AgentOperator:containsValue:AhrefsBot - Action: Block
- Save and deploy
Cloudflare also has a built-in “Bot Fight Mode” toggle (under Security → Bots) that blocks many SEO crawlers automatically — quicker than custom rules if you want to nuke them all at once.
Method 5: Block by IP range (when user-agent is being spoofed)
Sometimes attackers send fake AhrefsBot user-agent headers to disguise scraping. If you’ve already verified that a user-agent is fake (see “How to verify real AhrefsBot traffic” below) and you want to block at the network level, use the published IP ranges:
# iptables — block AhrefsBot IP ranges entirely
iptables -A INPUT -s 54.36.148.0/24 -j DROP
iptables -A INPUT -s 54.36.149.0/24 -j DROP
iptables -A INPUT -s 54.36.150.0/24 -j DROP
iptables -A INPUT -s 195.154.122.0/24 -j DROP
iptables -A INPUT -s 195.154.123.0/24 -j DROP
iptables -A INPUT -s 195.154.126.0/24 -j DROP
iptables -A INPUT -s 195.154.127.0/24 -j DROPThis drops packets at the OS level — even spoofed traffic from these IPs gets refused. Note that Ahrefs adds new IP ranges over time; this list is current as of 2026 but check their official documentation for the latest.
Will blocking AhrefsBot hurt my SEO?
No. AhrefsBot has nothing to do with how Google ranks your site. Google uses Googlebot — a separate crawler, with separate IPs, controlled by Google. Blocking AhrefsBot does not affect:
- Your Google rankings
- Your indexed pages in Google Search
- Your traffic from Google Search
- Bingbot, DuckDuckBot, or any other major search engine crawler
The only things blocking AhrefsBot affects:
- Ahrefs’ data on your site: If you use Ahrefs to monitor your own backlinks/keywords, the data goes stale. (Workaround: verify your site in Ahrefs Webmaster Tools — that uses a different crawler that you can allow while blocking AhrefsBot.)
- Yep.com visibility: Yep is Ahrefs’ search engine. Blocking AhrefsBot removes you from Yep — though Yep traffic is currently negligible for most sites.
- Competitor research from Ahrefs users: They won’t see your data in Ahrefs reports — could be a feature if you’d rather competitors not see your backlink profile.
Why people block AhrefsBot
- Hide backlink profile from competitors — by far the most common reason. Ahrefs is the standard tool for competitive backlink research, and blocking the bot blinds anyone trying to scrape your link strategy.
- Reduce server load — on small VPS or shared hosting, every crawler adds CPU/bandwidth. AhrefsBot is well-behaved but still costs something.
- Protect proprietary content — if you don’t want your content samples appearing in Ahrefs’ Top Pages or Content Explorer reports.
- You simply don’t use Ahrefs — no reason to let it crawl you if you get no value from it.
Slow AhrefsBot down instead of blocking
If you don’t want to block AhrefsBot entirely but it’s hitting your server too aggressively, add a Crawl-delay directive:
User-agent: AhrefsBot
Crawl-delay: 10That tells AhrefsBot to wait 10 seconds between requests. Increase the number for less frequent crawling. AhrefsBot honors Crawl-delay (Googlebot doesn’t, but that’s a different bot).
You can also adjust crawl rate through Ahrefs Webmaster Tools if you’ve verified ownership of your site there.
How to verify real AhrefsBot traffic (vs. spoofed)
Anyone can set the User-Agent header to “AhrefsBot” — scrapers do it routinely to disguise themselves. To verify a request is genuinely from Ahrefs, do a reverse DNS check:
# Step 1: Reverse DNS lookup on the source IP
host 54.36.148.1
# Should return something like:
# 1.148.36.54.in-addr.arpa domain name pointer crawl-54-36-148-1.ahrefs.com
# Step 2: Forward DNS lookup on the returned hostname
host crawl-54-36-148-1.ahrefs.com
# Should resolve back to: 54.36.148.1If the hostname doesn’t end in .ahrefs.com or .ahrefs.net, or if the forward and reverse don’t match, the traffic is spoofed. Block by IP at the firewall (Method 5 above).
AhrefsBot user-agent string
The exact user-agent AhrefsBot identifies itself with:
Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)The version number changes over time; the consistent identifier is AhrefsBot — that’s what you match in robots.txt rules and server configs. Note there’s a separate bot called AhrefsSiteAudit that runs when Ahrefs users audit their own sites; if you’re verified in Ahrefs Webmaster Tools, you can allow AhrefsSiteAudit while blocking AhrefsBot.
AhrefsBot IP address ranges
Ahrefs publishes the IP ranges AhrefsBot crawls from. Use these to verify traffic or block at the network level:
54.36.148.0/24
54.36.149.0/24
54.36.150.0/24
195.154.122.0/24
195.154.123.0/24
195.154.126.0/24
195.154.127.0/24This list isn’t exhaustive — Ahrefs adds ranges as they scale infrastructure. Their official IP documentation has the current canonical list. For real-time IP verification, you can use our AhrefsBot IP Address Checker.
AhrefsBot vs. other SEO crawlers
| Bot | User-agent | Owned by | Behavior |
|---|---|---|---|
| AhrefsBot | AhrefsBot |
Ahrefs | Polite, honors robots.txt + crawl-delay |
| SemrushBot | SemrushBot |
Semrush | Polite, honors robots.txt |
| MJ12bot | MJ12bot |
Majestic | Polite, can be aggressive on large sites |
| DotBot | DotBot |
Moz | Polite, honors robots.txt |
| SeznamBot | SeznamBot |
Seznam (CZ search) | Polite, geographic relevance only |
If you decide to block AhrefsBot, consider whether to also block its peers. The combined block rule for all major SEO crawlers (in robots.txt):
User-agent: AhrefsBot
Disallow: /
User-agent: SemrushBot
Disallow: /
User-agent: MJ12bot
Disallow: /
User-agent: DotBot
Disallow: /Frequently asked questions
How long does it take for AhrefsBot to stop crawling after I block it?
AhrefsBot reads robots.txt on every visit, so the rule takes effect within hours. If you used .htaccess, Nginx, or Cloudflare WAF, the block is instant — the server starts returning 403 immediately.
Will blocking AhrefsBot hurt my Google rankings?
No. AhrefsBot is a third-party SEO tool’s crawler, completely separate from Googlebot. Blocking AhrefsBot has zero effect on your visibility in Google Search.
Can I block AhrefsBot but still see my own data in Ahrefs?
Yes — verify your site in Ahrefs Webmaster Tools. Verified sites are crawled by AhrefsSiteAudit (a separate bot), which you can allow while blocking the public AhrefsBot:
User-agent: AhrefsBot
Disallow: /
User-agent: AhrefsSiteAudit
Allow: /Why is AhrefsBot crawling my site so frequently?
Ahrefs prioritizes crawl frequency by domain authority — high-DR sites get visited more often. If you don’t want the load, add a Crawl-delay: 10 (or higher) directive in robots.txt to throttle, or block entirely.
Does Cloudflare’s “Bot Fight Mode” block AhrefsBot?
Yes — the “Likely Automated” rules in Cloudflare’s bot management catch AhrefsBot along with most other SEO crawlers. If you turn it on, you don’t need separate WAF rules. Just be aware it also blocks legitimate tools like uptime monitors, so check your monitoring still works after enabling.
What if I see AhrefsBot user-agent traffic from non-Ahrefs IPs?
That’s spoofed traffic — someone is scraping your site and disguising the bot. Verify with reverse DNS (instructions above), and if it’s spoofed, block at the IP level rather than user-agent.
Is there a list of all bots I should block?
Depends on your goals. For competitor backlink secrecy: AhrefsBot, SemrushBot, MJ12bot, DotBot. For server load: also block AI scrapers (GPTBot, CCBot, Google-Extended). For pure spam: block any bot you don’t recognize that’s hitting your site frequently.
Bottom line
For most sites, the right answer is add the two-line robots.txt rule and move on. AhrefsBot respects it, the block takes effect within a day, and you don’t sacrifice anything Google-related. If you want a guaranteed hard block, use the .htaccess or Nginx config above. If you’re on Cloudflare, the WAF rule is the cleanest option of all.