Crawl-Delay is a robots.txt directive that asks a crawler to wait a set number of seconds between requests. It is used to limit request rates and reduce load on a site. Support is inconsistent across crawlers, so it should be treated as a courtesy signal rather than a reliable enforcement mechanism.
What Crawl-Delay Means for Crawlers and Site Operators
Crawl-Delay is a polite request, not a hard control. It tells a crawler to pause between requests so the site is less likely to experience burst load, but crawler support varies and some bots ignore it entirely. That makes it useful as a signalling mechanism, not as a reliable enforcement boundary.
Because robots.txt is publicly visible, Crawl-Delay is better understood as coordination metadata than as access control. It can shape well-behaved crawling behaviour, but it does not authenticate a bot, enforce identity, or guarantee that requests will stop at the advertised rate.
How Crawl-Delay Works in robots.txt
The directive sits alongside other robots.txt instructions and is read by crawlers that choose to honour it. The value is expressed as a number of seconds between requests, which means its practical effect depends on how the crawler interprets that number and whether it applies it per host, per user agent, or in some other implementation-specific way.
In practice, this makes Crawl-Delay a compatibility feature rather than a standardised traffic-shaping control. Search engines and other crawlers differ in whether they support it, how they parse it, and whether they treat it as a global limit or a hint tied to a specific user agent.
Why Crawl-Delay Is Used
Site operators usually use Crawl-Delay when they want to reduce request pressure from automated traffic without blocking access altogether. It is especially relevant for smaller sites, fragile back-end systems, or content estates where aggressive crawling can create unnecessary latency, log noise, or transient resource spikes.
It can also be a practical courtesy signal when a publisher prefers gradual indexing over rapid fetching. That said, if the business requirement is strict traffic governance, a robots.txt hint is usually too weak on its own and should be paired with server-side rate limiting, caching, and crawler-specific allowlisting or throttling where appropriate.
Limitations and Operational Trade-offs
Crawl-Delay is easy to publish, but easy to bypass. A crawler can ignore it, a malicious scraper can deliberately disregard it, and some legitimate crawlers may not support it at all. The result is that the directive reduces expected load only when the recipient cooperates.
The trade-off is between convenience and control. A lower-friction publishing model is simple to deploy, but it gives operators little assurance under abusive or poorly behaved crawling. If overuse becomes a concern, the real control point is usually server enforcement, not the robots.txt file itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Crawling exposure is reduced by controlling automated access patterns to web resources. |
| Recommendation — Limit abusive automated web access with server-side protections and rate controls. | ||
| NIST CSF 2.0 | PR.DS-4 — Data is Adequately Backed Up | The term concerns preserving service stability by reducing avoidable request load on a site. |
| PR.PO-01 — Policies and processes to manage cybersecurity risks are established, communicated, and enforced | robots.txt directives are an operational policy signal about how automated clients should behave. | |
| Recommendation — Reduce service strain by tuning controls that protect availability and traffic handling. Define and communicate crawler-handling policy alongside technical enforcement controls. | ||
| OWASP ASVS | V13 — Configuration | robots.txt handling is a configuration concern for how a site presents crawler directives. |
| Recommendation — Validate crawler-facing configuration so robots.txt directives reflect intended behaviour. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org