Technical SEO & Indexability

robots.txt: The Gatekeeper File

It is the first file a crawler looks for on your domain, it is a few plain-text lines, and one wrong character can quietly hide your best pages from crawling. The catch most people miss: it still cannot remove a page from Google.

Junaid KhalidUpdated 9 min readIntermediateIncludes a 6 min video

The short answer

A robots.txt file tells crawlers which paths on your site they may fetch. It lives at your domain root, groups rules by user-agent, and uses Disallow and Allow to open or close paths. Optimizing it means allowing everything Google needs to render your pages, closing off paths with no search value, pointing to your sitemap, and resisting the urge to block things you do not fully understand.

The rule that prevents most disasters: robots.txt controls crawling, not indexing. To keep a page out of Google you need a noindex tag, and the page must stay crawlable for Google to see it.

  • Disallow blocks crawling. It does not remove a URL from Google.
  • Never block CSS or JavaScript that Google needs to render the page.
  • Build and validate changes before you deploy. A stray Disallow: / can hide a whole site.

Crawling Is Not Indexing

This one distinction causes more robots.txt mistakes than anything else. Crawling is Google fetching and reading a page. Indexing is Google deciding to store it and show it in results. Robots.txt only affects the first step.

So if you Disallow a page, Googlebot will not read its content. But if another site links to that URL, Google can still index the bare URL and show it in results, usually with no useful description because it was never crawled. That is the opposite of what people expect when they block a page to hide it.

To remove a page from Google, do not use Disallow

Add a <meta name="robots" content="noindex"> tag (or the X-Robots-Tag header), and leave the page crawlable so Google can see it. Our guide to using noindex tags covers the full pattern.

An Annotated robots.txt Example

A good robots.txt is short and legible. Here is a safe starting point. Every line is a deliberate choice, not a default copied from a forum.

/robots.txt
User-agent: *# The rules below apply to all crawlers
Allow: /# Public content is open to crawling
Disallow: /admin/# No search value, keep crawlers out
Disallow: /cart/# Checkout and cart pages do not belong in search
Disallow: /search# Internal search result pages
Disallow: /*?sort=# Sort and filter parameter URLs (large sites)
 
User-agent: GPTBot# OpenAI training crawler
Disallow: /# Opt out of training, optional
 
User-agent: Google-Extended# Google AI training, not Search
Disallow: /# Does not affect Google ranking
 
Sitemap: https://example.com/sitemap.xml# Absolute URL, discovered by all engines

Build and test your own version with our free robots.txt generator before you deploy, then confirm Google can parse it with the robots.txt report in Search Console.

Google's Martin Splitt explains, in under six minutes, how robots.txt interacts with the robots meta tag and HTTP headers, and when noindex is the right tool instead of disallow.Video: How Robots.txt Works by Google Search Central. Loads from YouTube only when you press play.

What to Disallow and Allow

Reasonable to disallow

  • xAdmin, dashboard and login paths
  • xCart, checkout and order-confirmation pages
  • xInternal search result pages
  • xFaceted-navigation and sort parameters (large sites)
  • xAPI endpoints that serve no public HTML
  • xStaging or preview paths that leaked to production

Always keep allowed

  • +All CSS and JavaScript needed to render pages
  • +Every page you want to rank in search
  • +Images used in public content
  • +Fonts and other rendering assets
  • +Your XML sitemap location (declared, not blocked)
  • +Any page that carries a noindex tag

The last point catches people out: a page you want out of search must stay crawlable so Google can read its noindex. Block it in robots.txt and the noindex never gets seen.

Crawl Budget: When It Matters

Crawl budget is how much crawling Google is willing and able to do on your site. It is a real constraint, but Google is clear that most sites never need to think about it. It starts to matter on large sites, roughly those with hundreds of thousands of URLs, or sections that change so often that crawlers struggle to keep up.

On those sites, robots.txt can help by keeping crawlers away from genuinely low-value, near-infinite paths: filter and sort parameters, internal search, calendar pages that go on forever. But blocking is only one lever. Google gets more from a healthy URL inventory: returning 404 or 410 for pages that are gone, fixing long redirect chains, consolidating duplicates, and keeping sitemaps accurate so crawlers spend their time on URLs that earn.

If this is your situation, the dedicated guide to crawl budget optimization goes deeper, and XML versus HTML sitemaps explains the sitemap side.

AI Crawlers: Block the Right Ones

A newer reason people edit robots.txt is to control AI crawlers. The mechanism is the same as for any bot: a user-agent group with a Disallow. What changes is the token for each company, and keeping two categories straight matters a lot.

AI training crawlers (safe to block)

Tokens such as Google-Extended, GPTBot, ClaudeBot and CCBot gather content for training models. Google confirms that blocking Google-Extended has no effect on how you rank in Search, because Search uses the separate Googlebot.

Search crawlers (never block)

Googlebot and Bingbot are how you appear in search at all. Blocking them removes you from Google and Bing. Confirm the exact token on the engine's own crawler list before you write any rule that names a bot.

Two honest caveats. Robots.txt is a request that well-behaved crawlers honour, not an enforced barrier, so a disallow deters the cooperative bots and not the rest. And tokens change over time, so check the current user-agent strings rather than trusting an old snippet.

Catch a bad rule before it costs you.

Murkuz connects Google Search Console to Claude or ChatGPT. After a robots.txt change, ask "which of my pages are excluded from the index, and why?" and Inspect_URL plus the indexing rows show what Google can and cannot reach. It reads your data through the official API. It does not edit your site.

See the Search Console connector

Further reading

The sources behind this guide, starting with Google's own documentation and the formal standard. Each one was opened and read before it was added here.

  • Official docsGoogle Search Central

    Introduction to robots.txt

    Start here. It states plainly what robots.txt is for and the thing most people get wrong: it controls crawling, not whether a URL can appear in Google.

  • Official docsGoogle Search Central

    How to write and submit a robots.txt file

    The syntax reference for user-agent, disallow, allow, wildcards and the sitemap directive, plus the rules on file location, size and encoding.

  • Official docsGoogle Search Central

    Robots meta tag, data-nosnippet, and X-Robots-Tag specifications

    The right tool when you actually want a page out of the index. Explains noindex and the X-Robots-Tag header, and why the page must stay crawlable for either to work.

  • Official docsGoogle Search Central

    Overview of Google crawlers and fetchers (user agents)

    The full list of Google user-agent strings, including Google-Extended for AI training. Essential before you write a rule that names a specific bot.

  • Official docsGoogle Search Central

    Optimize your crawl budget

    Who actually needs to care about crawl budget (large sites) and what helps: consolidating URLs, clean status codes and fresh sitemaps, not just blocking folders.

  • StandardIETF

    RFC 9309: Robots Exclusion Protocol

    The formal standard behind robots.txt, published in 2022. Useful when you need the exact, vendor-neutral rules for parsing and matching.

Frequently Asked Questions

Does robots.txt stop a page from appearing in Google search results?

No, and this is the single most important thing to understand. Robots.txt controls crawling, not indexing. If you disallow a page, Googlebot will not read its content, but Google can still list the URL in search results if other pages link to it, often with no description because it was never crawled. To keep a page out of the index, you need a noindex rule instead, and Googlebot has to be allowed to crawl the page in order to see that rule. Blocking a page in robots.txt and expecting it to drop out of Google is one of the most common SEO mistakes.

What is the difference between Disallow and noindex?

Disallow is a robots.txt directive that asks a crawler not to fetch a path. Noindex is a signal, set either as a meta robots tag in the page's HTML head or as an X-Robots-Tag HTTP header, that tells Google not to show the page in search results. They solve different problems. Use Disallow to stop crawling of areas with no search value or to protect server resources. Use noindex to remove a page from search. They also conflict: if you Disallow a page, Google cannot crawl it to discover the noindex, so the two cancel out. Never block a page you are trying to noindex.

Should I block CSS and JavaScript in robots.txt?

No. Google renders pages much like a browser, running JavaScript and applying CSS to see the final layout and content. If your robots.txt blocks those files, Google renders an incomplete version of the page and may miss navigation, content injected by scripts, or structured data. The result can be lower-quality indexing of pages that are otherwise fine. Allow all rendering resources, and if you are unsure, use the URL Inspection tool in Search Console to view the page exactly as Googlebot renders it.

Where does robots.txt go, and what format does it need?

The file must live at the root of each host, for example https://example.com/robots.txt, and it only applies to that exact host, protocol and port. A subdomain or an http versus https version needs its own file. It must be named robots.txt in lowercase, be plain text encoded as UTF-8, and stay within Google's 500 kibibyte limit, beyond which the rest is ignored. Rules are grouped by user-agent, and each group lists its Disallow and Allow paths.

How do I block AI crawlers, and does it affect my Google ranking?

You block them the same way you block any bot: a user-agent group with Disallow in robots.txt. The tokens differ by company, for example Google-Extended for Google's AI training, GPTBot for OpenAI, ClaudeBot for Anthropic and CCBot for Common Crawl. Blocking Google-Extended controls whether your content trains Google's AI models, and Google confirms it has no effect on how you rank in Search, because that is governed by the separate Googlebot. The key is to never block the search crawlers themselves, Googlebot and Bingbot, as that would remove you from search. Remember too that robots.txt is a request that well-behaved crawlers honour, not an enforced wall.

Does robots.txt help with crawl budget?

For most sites, crawl budget is not something you need to manage, and Google says so. It becomes relevant on large sites, roughly those with hundreds of thousands of URLs or sections that change very frequently. There, disallowing genuinely low-value paths such as faceted-navigation parameters, internal search results and infinite-scroll variants can stop crawlers wasting time on them. But blocking is only part of it. Returning clean status codes, avoiding long redirect chains, consolidating duplicate URLs and keeping sitemaps current all matter more to how efficiently Google crawls you.

How often does Google re-read my robots.txt?

Google generally caches robots.txt for up to 24 hours, so a change can take about a day to take full effect. If you have made an urgent fix, such as removing a rule that was accidentally blocking important pages, you do not have to wait: open the robots.txt report in Search Console to confirm Google can fetch and parse the new file, and the cached version will be refreshed. If Google cannot reach the file at all, it will use the last good version it has for a time before treating the site as fully allowed.

Know what Google can and cannot reach. Across every site you run.

Connect Google Search Console once and ask, from Claude or ChatGPT, which pages are excluded from the index and why. Read-only, through the official APIs, with your own permissions.