A client recently got in touch asking whether her website images were "AI safe" - her safeguarding team had raised concerns about images potentially being scraped and used to train AI models. It's a question I hadn't had before, but it sent me down a research rabbit hole and I've since added these protections to all the websites I manage. So here's what I found out.
Why organisations are starting to worry about this
If your website contains images of real people - staff, service users, clients - there's a legitimate concern that AI bots could scrape those images and use them to train AI models, without anyone's knowledge or consent. For organisations working in sensitive sectors like mental health, healthcare, education or charities, that's a real safeguarding issue.
It's not just theoretical. AI companies have been known to crawl websites at scale to gather training data, and most websites have no protection in place at all.
What you can actually do about it
There are two layers of protection worth putting in place, and both are relatively straightforward on a WordPress website.
The first is a meta tag in the site header. Adding this line of code to the head of every page tells AI bots not to use your images for training purposes:
<meta name="robots" content="noai, noimageai">
If you're using Yoast SEO, you can add this via a plugin like Insert Headers and Footers without touching any theme files. No developer needed.
The second is your robots.txt file. This is a text file that tells bots what they can and can't do on your site. Adding entries for the major known AI crawlers looks like this:
User-agent: GPTBot
Disallow: /
User-agent: Google-Extended
Disallow: /
User-agent: CCBot
Disallow: /
User-agent: anthropic-ai
Disallow: /
User-agent: ClaudeBot
Disallow: /If you're using Yoast, you can edit your robots.txt file directly under SEO > Tools > File Editor. Just add the AI entries below the existing Yoast block - don't overwrite what's already there.
What these measures will and won't do
I want to be straight about this, because it matters if you're passing this information on to a safeguarding team.
These measures are respected by the major AI companies, and they give you a paper trail showing you've taken reasonable steps. That counts for something.
What they can't do is technically prevent every bot from ignoring them. Any crawler can simply disregard robots.txt or meta tags - they're more of a polite request than a hard block. Smaller or less scrupulous AI companies may not honour them, and any images already scraped before you add the protections are unaffected.
If you need stronger protection
For particularly sensitive images, the honest answer is that the most effective options are more fundamental:
Serving images behind a login means they're not publicly accessible to crawlers at all. Not publishing sensitive images on the public-facing website is the only guaranteed protection. Watermarking images makes them less useful for training purposes and adds a layer of visible ownership.
If a safeguarding team has real concerns about specific images, it's worth having that conversation about whether those images need to be on a public website at all.
My takeaway
I'm glad this client asked. It's prompted me to add these protections across all the websites I manage as standard, and it's a reminder that as website owners and managers, we're responsible for the data we put out there - including images.
If you'd like me to check whether your website already has these protections in place, or to add them for you, get in touch via the link below.
Get your free website health check here
