A page that must not be indexed and does not say so

Forbidden: An admin screen, a sign-in page, an internal tool with no robots directive, kept out of search by nothing but obscurity
Instead: noindex on the page itself, from its own metadata. In product and operator this is the default and its absence is the defect.

What this rule looks like

Forbidden

Instead

Why this rule

robots.txt is not this. It is public, advisory, and read by strangers as a list of interesting places: naming /admin there tells everyone where it is. A path is safe to name only when something else protects it — a session guard, an authenticating API — and never because the file asked politely.

Kind: Rule
Section: Things to avoid
Group: Search and sharing
Bucket: mechanical
Severity: error
Detector: metadata
Since: v0.14.0

Read as plain text