What it does and does not do
It manages crawling. Google says it is not a mechanism for keeping a page out of Google: a disallowed URL linked from elsewhere may still be indexed without its content. RFC 9309 states that the rules are not a form of access authorization. To keep a page out of search use noindex on a crawlable page; to keep it private use authentication.
How crawlers read errors
A 4xx response means no file, so no restrictions. A 5xx response or a network failure means the crawler must assume everything is disallowed; Google stops crawling for the first 12 hours, then uses its cached copy for up to 30 days. Google caches the file for up to about 24 hours and ignores content beyond 500 KiB.
An example
User-agent: *
Disallow: /admin/
Sitemap: https://example.com/sitemap.xmlThis allows everything except paths that begin with /admin/ and declares the sitemap. The dangerous version is Disallow: /, which blocks the whole site and is often left over from staging. Rules match by path prefix, * and $ are supported inside a path, and when several groups name a crawler it obeys only the most specific one, so a group for one crawler must repeat any rule from the general group that should still apply to it.
What to check
That production does not serve Disallow: /, that the file returns 200, that the Sitemap: line points to the right host and that no rule blocks the CSS and JavaScript pages need.
Sources
Read on . Standards and vendor pages change; confirm the current text before you rely on it.
- RFC 9309, Robots Exclusion Protocol (www.rfc-editor.org)
- Google Search Central, Introduction to robots.txt (developers.google.com)