Google's Crawler IP Ranges Moved: What Broke and How to Fix It | AiVIS Cite Ledger Blogs

By · · 11 min read · TECHNOLOGY

The old Google crawler IP endpoints stopped returning real data on 7 April 2026, but they didn't 404, they returned 200 OK with a JSON message. If your firewall, WAF, or bot verification pulls from them, you may already be running on empty allowlists.

Key Takeaways

  • Google moved crawler IP range files from /search/apis/ipranges/ to /crawling/ipranges/, and renamed googlebot.json to common-crawlers.json.
  • The old URLs return 200 OK with an "Action needed" JSON message instead of IP prefixes. No redirect, no 404.
  • One file (user-triggered-agents.json) still returns real but stale data from 2026-03-03 at the old URL, a different failure mode.
  • Systems using loose JSON parsing may silently ingest empty allowlists. Strict schemas will crash, which is actually the better outcome.
  • The fix is straightforward: update 5 endpoint URLs and add response schema validation to catch future changes.

Article

On 31 March 2026, Google announced that the JSON files listing their crawler IP ranges were moving from `/search/apis/ipranges/` to `/crawling/ipranges/` on developers.google.com. The reasoning made sense: these ranges cover crawlers used by Shopping, AdSense, Gemini, and other products beyond Search, so a `/crawling/` path better reflects their scope.

What the blog post didn't mention is that `googlebot.json` has also been renamed to `common-crawlers.json`. Updating the directory path alone isn't enough.

To complicate matters, the transition happened faster than expected. While Google promised a 6-month transition period, the old endpoints are already returning unexpected responses. If your systems pull from them automatically, they may be ingesting invalid data or failing silently.

What actually happened

On 7 April at 09:42:16 UTC, eight days after the announcement, the old URLs stopped returning IP ranges data.

The old URLs didn't redirect, and they didn't break. Instead, they quietly started returning a 200 response with a completely different JSON payload. For example, the response to the old `user-triggered-fetchers.json` endpoint was the following:

```json

{

"Action needed": "update the location you're fetching from to https://developers.google.com/static/crawling/ipranges/user-triggered-fetchers.json"

}

```

This matters because of how different HTTP status codes behave in practice.

A **301 or 308 redirect** is transparent. Most HTTP clients and automated scripts follow redirects by default, so systems can continue working without any changes. A **404 or 410** is disruptive, but disruption is useful: it triggers alerts, teams investigate, and the issue gets resolved quickly.

A **200 response with valid but non-standard JSON** that contains no IP data is a harder problem to catch. Without proper data validation, an automated script might fetch the URL, receive a successful response, parse the JSON without complaint, find no IP prefixes, and conti

Enable JavaScript for the full interactive reading experience with related articles and discussion.