What ChatGPT Actually Cites Now, and How to Get Your Product on the Shortlist

August 8: the day ChatGPT stopped trusting the crowd

Share of all ChatGPT citations, the week of August 1 to 7 against August 14 to 21. Before: reddit.com 5.46%, techradar.com 1.67%, arxiv.org 0.94%, g2.com 0.81%, wsj.com 0.71%. Reddit alone out-cited the next four domains put together. After: g2.com 0.86%, pubmed.ncbi.nlm.nih.gov 0.66%, microsoft.com 0.61%, consumerfinance.gov 0.60%, pmc.ncbi.nlm.nih.gov 0.59%. The IRS sits at number eight. Reddit, TechRadar and arXiv are gone from the top ten.

Three other panels caught the same cliff with their own prompt sets, and the numbers differ because the panels differ. Promptwatch: Reddit from 3.83% to 0.52%, an 86% drop, with the share of fanouts using a site: operator jumping from 0.37% to 16.8% on August 8. Qwairy: 2.04% to 0.10%, with institutional and .gov share rising from 17.1% to 29.6%. Otterly: Reddit citations per day from 497 to 132 across sixteen brand reports, while official brand pages gained in ten of fifteen. Elmo compared the app to the API: the app's Reddit share fell 92%, the API's stayed flat at under 1%.

One panel disagrees. Ahrefs Brand Radar, published September 2, still lists reddit.com as the most cited domain in ChatGPT at 16.8% and reports no drop, because it measures a search-backed query set built differently. Expect someone to quote it back at you. The honest reading is that Reddit lost most of its weight in the consumer app for product and advice queries, and that official pages took it.

Now look at the size of the winner. The old number one held 5.46% of every citation. The new number one holds 0.86%. The whole thing spread sideways. Official pages grew, and "official" does not automatically mean your product page. It means the page an authority would publish.

Find, then hone: fanouts and the safe_urls list

The second slide indexes activity so the August 1 to 6 average equals 100. From August 8 to September 7: fanout queries 170, safe URLs 102, citations 112. Seventy percent more searching to cite roughly the same number of pages. The filter got pickier.

The third slide is the useful one. For a question like "best running shoes?", ChatGPT runs a fanout, reasons about what came back, then runs another fanout. Everything it finds lands in a list the slide labels safe_urls. Then it reasons over that list and the slide quotes the model: these are the ones worth citing.

Two studies from earlier in the year put numbers on how narrow that second step is. AirOps ran 15,000 prompts and watched 548,534 pages get retrieved; 15% were cited. A fanout happened on 89.6% of searches, and 32.9% of cited pages only appeared through a fanout query, never the original prompt. Ahrefs looked at 1.4 million prompts: 88.46% of citations came through the search index, and the pages that got cited had titles far closer to the fanout query than the pages that did not. The gate is the title, the slug and the snippet, before anyone reads the page.

Which pages make the shortlist

Across engines, DeltaV Digital's July study of 25,337 citations found articles at 23.7%, listicles 19.6%, product pages 16.3% and homepages 10.8%. Comparison pages had the highest citations per retrieval of any format, 1.87, about 45% above average. In B2B tech, listicles alone took 61%. On Google AI Mode, Pillarbase found 47.7% of citations point at a single paragraph; the median passage was 117 words and 80% of them led with the answer.

So the shortlist is made of pages that look like this:

• A title that matches the sub-question. Ahrefs: cited pages scored 0.656 on title-to-fanout similarity against 0.484 for retrieved but uncited pages. AirOps: 50% or more title overlap doubled the cite rate, 20.1% against 9.3%.
• A natural-language slug. 89.78% of cited URLs had one, against 81.11% of the rest. Small, free, and it compounds.
• The answer in the first paragraph. A 100 to 200 word capsule that a model can lift whole, with the number, the date and the source in it.
• A comparison table or an attributed statistic. The formats with the best citations-per-retrieval are the ones that save the model a second search.
• Age and refresh. The median cited page was about 500 days old. You do not need to be new. You need to be maintained, and your commercial pages need a visible update every few weeks.

Traffic from a citation also changed shape in May, when ChatGPT started linking brand names inline. Similarweb saw referrals to homepages rise 354.7% in a week and pages per visit go from 3.8 to 4.7. The homepage became the landing page again, which makes the first paragraph of your homepage the most read paragraph you own.

The Cloudflare switch and the plumbing underneath

None of the above matters if the crawler cannot reach you, and in 2026 the most common way to block it is by accident. Cloudflare rebuilt its crawler controls on September 15 after reports in August that the old "Block AI Bots" toggle was returning 403s to Googlebot and Bingbot on some sites. Read this before you touch the dashboard.

You now set three things separately:

• Search: whether you get crawled for a search index. Allow, Block on pages with ads, or Block.
• Training: whether your pages train a model. The same three, plus a fourth, Disallow AI Training, which publishes a Disallow line in your robots.txt and leaves crawling alone.
• Agent: whether an assistant fetches you live for a user. Allow, Block on pages with ads, or Block.

Two more notes from the same change. New domains get a preset: no ads on the site and everything stays on Allow; ads on the site and Training goes to Disallow AI Training with Agent blocked on ad pages. And Bing does not read the robots.txt preference yet; Microsoft is targeting early 2027, so until then the Bing opt-out is the NOARCHIVE tag. AI Labyrinth, the honeypot feature, does not touch Googlebot, so it is not the culprit if you see 403s.

Then the part below Cloudflare. I built a free AI readiness test: paste a URL, it fetches the page once, reads the site around it, and runs 14 checks. No account. I ran it on my own launch directories page and got 33. Then on the homepage. Also 33, on a completely different set of failures. On a site I built for builders, it caught all of this:

• robots.txt names no AI crawlers at all; GPTBot and ClaudeBot fall through to the default rule
• no Markdown version of the page, so an agent swallows the full HTML
• the navigation gets read as if it were content
• a request asking for text/markdown still comes back as HTML
• no API catalog at the well-known path, while llms.txt names a live MCP server

The last one stung. The surface exists and the file that advertises it to a crawler does not. Three checks passed: llms.txt answers, nothing important is blocked, and the heading outline is a real outline. This is plumbing: robots.txt, a Cloudflare setting, and whether the page is readable. It is also the part that decides whether you ever reach the hone step.

What to fix first

This is the exact order I am fixing mine. Cheapest and most damaging first.

The number I still cannot see is how often ChatGPT and Claude cite this site. Cloudflare's AEO tab is built for exactly that: it runs Claude and GPT on the questions buyers in your category ask and shows how often they cite your site, how often they name your brand, and your share against competitors. I have asked for early access to mine. Agent Readiness is live on the same screen and calls this site Almost ready. That gets fixed too.