How to block Claude-Code
Operated by Anthropic. Claude Code is an AI coding agent by Anthropic that can build, debug, and ship code directly from the terminal, handling tasks like codebase onboarding, multi-file edits,… AI Coding Agent Fetches documentation and other resources to help build software
How it identifies itself
claude-code/2.1.169 (cli)
robots.txt
What the agent asks to be told. It obeys this or it does not — nothing enforces it.
User-agent: Claude-Code Disallow: /
nginx
In the server block, then reload.
# In the server block. 403 rather than 444: a closed connection tells the
# operator nothing, and an agent that gets a status code can log it.
if ($http_user_agent ~* "(Claude-Code|Claude Code)") {
return 403;
}
Apache
In .htaccess or the vhost.
BrowserMatchNoCase "Claude-Code" bad_bot
BrowserMatchNoCase "Claude Code" bad_bot
<RequireAll>
Require all granted
Require not env bad_bot
</RequireAll>
Cloudflare
Security → WAF → Custom rules.
# Security → WAF → Custom rules, action: Block (http.user_agent contains "Claude-Code") or (http.user_agent contains "Claude Code")
WordPress
A child theme's functions.php, or a small plugin.
// functions.php of a child theme, or a small plugin. Runs before WordPress
// builds the page, so a blocked agent costs one PHP process and no queries.
add_action('init', function () {
$agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
foreach (['Claude-Code', 'Claude Code'] as $needle) {
if (stripos($agent, $needle) !== false) {
status_header(403);
exit('Blocked: Claude-Code');
}
}
});
robots.txt is a request. The rules below it are the wall.
Claude-Code publishes a token, so the directive above will work for as long as it keeps honouring it — and nothing except its own good manners makes it. The server rules match on a header the requester sets, which stops the agent that says who it is and not the one that copies somebody else's name. Botscope verifies identity against DNS and published address ranges, records which check decided each request, and shows you the ones that lied.