Here is the short answer: on WordPress.com you cannot edit robots.txt on the Free plan at all, but you are not helpless. Every plan, including Free, has a setting called Prevent third-party sharing that opts your public content out of WordPress.com sharing deals, including AI training partners, and WordPress.com adds known AI bots to your site robots.txt disallow list when you turn it on. On any paid plan you can install an SEO plugin such as Rank Math or Yoast and edit robots.txt yourself. Since 2 April 2026, plugin installs work on every paid plan, starting with Personal, not only on Business as older guides still claim. The one thing no WordPress.com plan gives you is server-level control, so if you want to block crawlers with firewall rules or server configuration, you need self-hosted WordPress.org instead.
First, Know Which WordPress You Have
WordPress.com and WordPress.org share a name and the same editing screen, but they are different products, and the difference decides everything about AI crawler control. WordPress.com is a hosted service run by Automattic. You sign up, pick a plan, and Automattic runs the servers, handles updates, and decides which features each plan unlocks. WordPress.org is the free, open-source software itself. You download it, install it on hosting you choose, and there are no plan gates at all: every plugin, every theme, and every file, including robots.txt, is yours to change.
This matters because most guides about blocking AI crawlers on WordPress assume the self-hosted version. When a guide tells you to upload a robots.txt file to your server root or install a plugin and edit a file, that advice only works if you control the server. On WordPress.com you do not. There is no file manager access to the server root on the lower plans, no FTP on the Free plan, and no way to drop a file into the root folder. Your tools are the settings Automattic exposes and, on paid plans, the plugins Automattic allows. That is a smaller toolbox, but it still covers the crawlers most site owners care about, as long as you use the right tool for your plan.
If you are unsure which one you have, check your address bar. A site at yoursite.wordpress.com or a custom domain managed from wordpress.com is WordPress.com. A site where you log in at yourdomain.com/wp-admin and you chose the hosting company yourself is almost certainly WordPress.org. If you are on self-hosted WordPress, our guide to blocking AI crawlers on WordPress covers the full plugin and file approach. The rest of this article is for WordPress.com sites only.
What Each WordPress.com Plan Can and Cannot Do
The plan ladder changed in 2026, and this is where most articles you will find are now out of date. For years the rule was simple: plugins, including SEO plugins with robots.txt editors, were locked behind the Business plan. That changed on 2 April 2026, when WordPress.com opened plugin installation and theme uploads to every paid plan. Personal, Premium, Business, and Commerce can all install plugins now. Only the Free plan still cannot. Several plan guides checked against WordPress.com official documentation in late 2026 confirm the change, but plenty of older posts still say Business is required, so check the date on anything you read.
Here is the honest picture plan by plan, as of late 2026. The Free plan gives you a site on a wordpress.com subdomain, 1 GB of storage, and WordPress.com ads shown to your visitors. You cannot install plugins, you cannot use a custom domain, and you cannot edit robots.txt. What you can do is use the built-in privacy settings, which are covered below, and those settings are genuinely useful. The Personal plan, around four dollars a month billed yearly, removes the ads, adds a custom domain, and now includes plugin installs and theme uploads. The Premium plan, around eight dollars a month billed yearly, adds premium themes, payments, and Google Analytics, but for crawler control it adds nothing that Personal lacks. The Business plan, around twenty-five dollars a month billed yearly, adds the developer tools: SFTP, SSH, WP-CLI, staging sites, and automatic backups with one-click restores. The Commerce plan, around forty-five dollars a month billed yearly, adds managed WooCommerce features for stores. Prices change, so confirm them at checkout, but the structure is what matters: crawler control through plugins starts at Personal, and server-level control does not exist on any WordPress.com plan, Business included.
Two limits apply on every plan. First, WordPress.com keeps a short list of incompatible plugins that it blocks because they duplicate platform features or strain shared infrastructure, so a plugin that works on self-hosted WordPress is not guaranteed to work here. Second, installing a plugin on Personal or Premium activates WordPress.com hosting features for your site, which can change how your site is served. Neither limit should stop you, but both are worth knowing before you pay for a plan upgrade purely for crawler control. If all you want is to stop AI training crawlers, the free privacy setting below may already be enough, and you may not need to upgrade at all.
Step 1: Turn On Prevent Third-Party Sharing (Every Plan, Including Free)
This is the single most important setting on WordPress.com, and it is available on every plan, including Free. It is the opt-out Automattic built after it became public that WordPress.com content could be shared with third parties, including AI training platforms. By default, your public WordPress.com content is eligible for sharing with WordPress.com third-party content and research partners. Turning this setting on excludes your site from that sharing.
To find it, log in to your WordPress.com dashboard and open your site settings. In the newer WordPress.com dashboard the toggle lives under Settings, then General, in the privacy section, labelled Prevent third-party sharing, followed by your site address. In the classic WP-Admin view the same option sits under Settings, then Reading, under Site Visibility. WordPress.com has moved this setting between screens more than once, so if you do not see it in one place, check the other. The official support page explains it at wordpress.com/support/privacy-settings. You need to turn it on separately for every WordPress.com site you own; the setting is per site, not per account.
Two things happen when you enable it. First, WordPress.com stops sharing your public content with its network of third-party partners. Second, according to WordPress.com own documentation, the platform adds known AI bots to the disallow list in your site robots.txt file. That is the closest thing to a robots.txt edit that the Free plan gets, and it is done for you automatically.
There are limits, and Automattic is open about them. The setting only controls sharing through WordPress.com. It does not force an outside AI company to stop crawling your site directly, and it does not remove content that was already shared or collected. Outside platforms ultimately have to honour the instructions in robots.txt themselves. If you already chose to discourage search engines from indexing your site, WordPress.com applies that privacy preference to third-party sharing automatically, so you may already be opted out without knowing it. Private, password-protected, and deleted posts are never shared in any case. The setting only covers public content.
Do this first, before anything else in this guide, whatever plan you are on. It takes thirty seconds, it costs nothing, and it is the only control WordPress.com built specifically for the AI training question. Everything else below is an extra layer on top of it.
Step 2: Understand the Discourage Search Engines Setting (Use With Care)
Every WordPress site, hosted or self-hosted, has a setting that asks search engines not to index the site. In WP-Admin it sits under Settings, then Reading, labelled Discourage search engines from indexing this site. On WordPress.com it appears under Site Visibility alongside the third-party sharing toggle. Turning it on adds a noindex instruction to your pages, which tells Google and other search engines to drop your site from their results.
Do not turn this on unless you genuinely want your site hidden from Google Search. That is the trade, and it is a bad one for most site owners. The setting does not target AI crawlers specifically; it targets all search engines at once. Your pages disappear from Google, your traffic from search drops to near zero, and you also lose eligibility for Google AI Overviews and AI Mode, because those features are built on the regular search index and need your pages indexed first. If your goal is to keep AI training crawlers out while staying visible in search, this setting is the wrong tool. It is a visibility switch, not an AI switch.
There is one situation where it makes sense: a private project, a staging copy of a site, or a blog you never want found through search. In that case, turn it on and you are done; the search discouragement also triggers the third-party sharing opt-out automatically, as noted above. For a public blog, business site, or portfolio that you want people to find, leave it off and use the targeted controls in the rest of this guide instead.
What You Can Do on the Free Plan
If you stay on the Free plan, your options are the two settings above plus good publishing hygiene. That is a shorter list than self-hosted owners get, but it is not nothing, and it is worth doing properly rather than assuming the Free plan leaves you defenceless.
First, turn on Prevent third-party sharing as described above. Second, decide deliberately about the search discouragement setting, and leave it off if you want search traffic. Third, check your live robots.txt file. Open yoursite.wordpress.com/robots.txt in a browser and look for the AI bot names. You cannot edit this file, but you should know what it says after you change the privacy setting, because it tells you which crawlers WordPress.com is already turning away on your behalf. If you see GPTBot and other training crawlers listed with Disallow rules, the platform setting is doing its job.
Fourth, think about where your best work lives. Anything you publish only on a Free WordPress.com site is governed by WordPress.com robots.txt, not yours. If a particular piece of writing or research is something you never want in a training dataset, consider publishing it on a platform you control, or keeping it off the public web entirely. That is a content decision, not a technical fix, but on a plan with no robots.txt access it is the only fully reliable one.
Finally, do not waste money on workarounds that cannot work on the Free plan. You cannot add a plugin, you cannot upload a file, and you cannot add a custom domain, so any guide that tells a Free-plan user to install Rank Math or point Cloudflare at their site is describing a different plan. The upgrade that unlocks plugins is Personal, the cheapest paid plan, not Business, and that is worth knowing before you pay for more than you need.
The Paid-Plan Path: Edit robots.txt With an SEO Plugin
On any paid WordPress.com plan, Personal included, you can install an SEO plugin and edit robots.txt from your dashboard. The two plugins most people use are Rank Math and Yoast SEO, and both include a robots.txt editor in their free versions. Rank Math puts its editor under Rank Math, then General Settings, then Edit robots.txt, and it offers a visual rule builder as well as a raw text editor. Yoast puts its file editor under SEO, then Tools, then File editor, with tabs for robots.txt and the server configuration file.
Before you start, one practical warning: WordPress.com runs your site on its own managed platform, and the platform generates its own robots.txt. An SEO plugin edits the virtual robots.txt that WordPress generates, and in most cases the plugin version is what visitors see. But you must verify it. After saving your rules, open yoursite.com/robots.txt in a browser, or your custom domain followed by /robots.txt, and confirm your new lines actually appear. If they do not, the platform file is winning over the plugin, and you need to check the plugin documentation or WordPress.com support before assuming you are protected. Never trust a saved setting you have not seen live.
Here is the step-by-step path with Rank Math. First, upgrade to any paid plan if you have not already, then go to Plugins, then Add New, search for Rank Math SEO, install it, and activate it. Run through its setup wizard and choose the advanced mode when it asks, because the robots.txt editor is an advanced feature. Then go to Rank Math, then General Settings, then the Edit robots.txt tab. You will see the current file contents. Add your rules at the end, save, and then check the live file as described above. With Yoast the path is the same idea: install and activate Yoast SEO, then go to SEO, then Tools, then File editor, click into the robots.txt editor, add your rules, and save.
One more caution: WordPress.com keeps a list of plugins it blocks, and while the big SEO plugins are allowed, a smaller robots.txt plugin might not be. Stick with Rank Math or Yoast, which are widely used on WordPress.com, and avoid installing three SEO plugins at once. Two plugins fighting over the same file is a reliable way to end up with rules that look saved and never appear live.
What to Put in Your robots.txt
The rules you add depend on what you want to stop. Most site owners want the same split: block the crawlers that collect content for AI model training, but stay visible in Google Search and in AI search answers that can send readers back. That split is possible because training crawlers and search crawlers are different bots with different names.
A solid starting point blocks the four training crawlers that matter most, while leaving the search crawlers alone:
User-agent: GPTBot Disallow: / User-agent: ClaudeBot Disallow: / User-agent: CCBot Disallow: / User-agent: Google-Extended Disallow: /
GPTBot is OpenAI training crawler, ClaudeBot is Anthropic training crawler, and CCBot is Common Crawl bot, which builds a public dataset many AI models train on. Google-Extended is not a crawler at all; it is a permission token Google reads from robots.txt that controls whether your content may be used to train future Gemini models and to ground answers in the Gemini app. Blocking it does not affect your Google Search ranking or your eligibility for AI Overviews, because those are driven by Googlebot, not by Google-Extended. Our Google-Extended guide explains that distinction in full.
If you also want to stay out of Perplexity answers, add a group for PerplexityBot. If you want to stay out of ChatGPT search answers as well as OpenAI training, add a group for OAI-SearchBot, but understand the trade: OAI-SearchBot is the crawler behind ChatGPT citations, so blocking it means ChatGPT stops citing your pages. Do not block GPTBot and assume ChatGPT citations stop too; they are separate crawlers, and blocking one does not block the other.
Never add a blanket rule that blocks every crawler. A group that names every user agent with Disallow for the whole site tells Googlebot to stay away too, and your pages will drop out of Google Search entirely. If you are building these rules by hand and want to be sure the syntax is right, our free robots.txt generator builds the file from checkboxes, and our robots.txt tester checks a file before you publish it. Paste your finished rules into the tester, confirm each crawler shows the result you intended, and only then save them in the plugin.
The Advanced Option: Cloudflare in Front of a Custom Domain
There is one more layer available to paid-plan owners with a custom domain, and it is worth knowing about even if you never use it. Because WordPress.com gives you no server-level access on any plan, you cannot write firewall rules on the server itself. But if your site uses a custom domain, you can route that domain DNS through Cloudflare and use Cloudflare bot controls to challenge or block AI crawlers before they ever reach WordPress.com. Cloudflare offers AI bot blocking controls that work at the network edge, independent of robots.txt.
This is an advanced setup, not a beginner one. Pointing a domain at Cloudflare changes your DNS, and a wrong DNS change can take your site offline or break your SSL certificate. WordPress.com has its own documentation for connecting a custom domain, and Cloudflare has its own for its bot controls, so read both before touching anything, and only attempt it if you are comfortable managing DNS records. It also requires a custom domain, which means at least the Personal plan. Free-plan sites on a wordpress.com subdomain cannot do this at all.
For most WordPress.com owners, the plugin path plus the privacy setting is enough, and Cloudflare is overkill. Consider it only if you have evidence that crawlers are ignoring your robots.txt rules, which you can check in your site statistics, or if you run a high-value content site where training crawlers are a genuine business problem. A request file that the major AI companies respect covers the reputable crawlers; a network firewall is for the ones that do not respect it.
When to Move to Self-Hosted WordPress.org
There comes a point where WordPress.com, on any plan, is the wrong home for a site whose owner wants full crawler control. If you need server-level blocking rules, if you need to block crawlers by IP address or user agent at the server, if you need a plugin WordPress.com blocks, or if you need to serve a custom robots.txt or llms.txt file that the platform will not override, self-hosted WordPress.org is the answer. There, every file is yours, every plugin installs, and no platform file sits above your own.
Moving is not a small job. You need hosting, a migration of your posts and media, and a redirect plan so your old addresses keep working. WordPress.com offers export tools, and most managed WordPress hosts offer free migrations. Do it because you have outgrown the platform, not because a single crawler annoyed you. For most blogs and small business sites, the combination of Prevent third-party sharing and a plugin-managed robots.txt on a paid plan covers the real risks, and the money is better spent on content than on a migration.
One honest note about timing: if you do move, do it before your content library gets large. Migrating ten posts is an afternoon. Migrating a thousand posts, with images, comments, and subscribers, is a project. If you already suspect you will want full control within a year, moving sooner is cheaper than moving later.
Frequently Asked Questions
Can I edit robots.txt on WordPress.com Free?
No. The Free plan does not allow plugin installs, custom domains, or file access, so there is no way to edit robots.txt directly. Use the Prevent third-party sharing setting instead, which opts your public content out of WordPress.com sharing deals and adds known AI bots to your site robots.txt disallow list automatically.
Do I need the Business plan to install Yoast or Rank Math on WordPress.com?
Not any more. Since 2 April 2026, plugin installation works on every paid WordPress.com plan, starting with Personal. Older guides that say Business is required are out of date. Business still adds developer tools such as SFTP, SSH, staging, and backups, but it is no longer the gate for plugins.
Where is the Prevent third-party sharing setting?
In the WordPress.com dashboard, go to Settings, then General, and look in the privacy section for the Prevent third-party sharing toggle. In the classic WP-Admin view, go to Settings, then Reading, under Site Visibility. Turn it on separately for each site you own. If you already discouraged search engines from indexing your site, WordPress.com applies the opt-out automatically.
Does blocking AI crawlers on WordPress.com hurt my Google ranking?
Not if you block the right crawlers. Blocking GPTBot, ClaudeBot, CCBot, and Google-Extended does not affect Google Search, because none of those controls Googlebot. Blocking Googlebot itself, or adding a blanket rule that blocks every crawler, would remove your pages from Google Search, so never do that by accident. Check your finished file in our robots.txt tester before saving it.
Does the Prevent third-party sharing setting stop all AI crawlers?
No. It stops WordPress.com from sharing your content with its third-party partners, and WordPress.com adds known AI bots to your robots.txt disallow list, but it cannot force an outside company to obey. Reputable AI crawlers respect robots.txt, but scrapers that ignore the file need stronger measures, such as a network firewall, or a move to a host you control.
Should I use the Discourage search engines setting to block AI crawlers?
Only if you want your site hidden from Google Search entirely. The setting tells all search engines to drop your pages, which also removes you from AI Overviews and AI Mode. For a public site that wants search traffic, it is the wrong tool. Use Prevent third-party sharing plus targeted robots.txt rules instead.
The bottom line is simple. On WordPress.com, start with the free privacy setting, because it is the only control built for the AI training question and it works on every plan. If you are on a paid plan, add a plugin-managed robots.txt that blocks training crawlers while leaving Googlebot alone, and verify the live file after every change. If you need more control than that, the honest answer is self-hosted WordPress, where the file is finally yours.
