How do I verify a Perplexity crawler request?

Definition: Verification of a Perplexity request combines a match for its User-Agent header with a check that its source IP address belongs to the corresponding published IP ranges. As of 17 October 2026, Perplexity documents this combined method for PerplexityBot and Perplexity-User.

Key facts

• Perplexity's crawler documentation recommends combining User-Agent matching and IP address verification in firewall rules.
• The official PerplexityBot IP list contains a prefixes array with ipv4Prefix entries, including 18.97.1.228/30.
• The separate Perplexity-User IP list uses the same structure and includes 18.97.21.0/30.

Which User-Agent belongs to which request?

Perplexity's published identifiers distinguish PerplexityBot, which serves search results, from Perplexity-User, which supports user actions. The full strings are:

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)

Where does the source address come from?

A User-Agent is identifying information reported by the client, according to Apache's access log documentation. Its value supplies the name to check against Perplexity's corresponding list.

Apache's Combined Log Format records this header through %{User-agent}i. Its %h field records the remote client's IP address unless hostname lookups replace it with a hostname. When a proxy sits between the requester and the server, that field can contain the proxy's address. The comparison therefore requires an address representing the original requester.

The same documentation identifies %>s as the response status field. It helps separate the identity check from the outcome of the request, such as a successful response or a server error.

How is an address compared with a published range?

The slash suffix in an IP prefix specifies the network mask. Python's ipaddress documentation explains network prefixes and provides address membership tests with in.

The following implementation applies that documented operation to the downloaded JSON structure. Saved as verify_ip.py, it takes a source address followed by the filename of the corresponding IP list:

import ipaddress
import json
import sys

address = ipaddress.ip_address(sys.argv[1])
with open(sys.argv[2], encoding="utf-8") as source:
    entries = json.load(source)["prefixes"]

networks = [
    ipaddress.ip_network(value)
    for entry in entries
    for key, value in entry.items()
    if key in ("ipv4Prefix", "ipv6Prefix")
]
print(any(address in network for network in networks))

True means the address belongs to a listed network. The User-Agent match remains a separate part of the check. An address outside the supplied list fails this membership test.

How does this become a firewall rule?

A web application firewall filters requests before they reach website content. Perplexity's AWS WAF guidance combines IP sets with their corresponding User-Agent strings. It recommends refreshing the lists periodically and monitoring logs after rule changes.

Related terms

• PerplexityBot
• Perplexity-User
• Server log analysis
• User-agent spoofing

FAQ

Can I allow requests using the User-Agent alone?

Perplexity's documented firewall method combines the header match with IP verification. Apply both conditions when allowing requests under that method.

Which file should I use for Perplexity-User?

Use the official perplexity-user.json endpoint. Match that list with the Perplexity-User identifier in the request header.

Sources

1. Perplexity, "Perplexity Crawlers", undated, accessed 17 October 2026
2. Perplexity, "PerplexityBot published IP addresses", retrieved 17 October 2026
3. Perplexity, "Perplexity-User published IP addresses", retrieved 17 October 2026
4. Apache Software Foundation, "Log Files", undated, accessed 17 October 2026
5. Python Software Foundation, "ipaddress", undated, accessed 17 October 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer