How to keep staging and dev sites out of Google
A public staging copy competes with the live site and often runs old code. Password-protect it or add noindex everywhere.
Step by step, with screenshots: Staging with WordPress: host tools, plugins and the noindex trap →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free WordPress health check.
What it is
A staging site is a private copy of your website where you test updates, new designs and plugins before they go live, often on a subdomain such as staging.example.com or a temporary domain from your host. Dev and test sites are the same idea under other names.
When a staging copy is public and indexable, Google can find it and index duplicate content that competes with your real pages, and visitors may land on an outdated site. Attackers look for staging copies too, because they often run old, unpatched code. getReport checks common staging hosts for your domain and flags one that answers without noindex. A staging site is OK when it asks for a password or sends noindex on every page.
What a passing site looks like
- No public staging copy foundfail · −5 ptseffort S
Public staging copy
Why it matters. A staging or dev copy that Google can index competes with the live site for its own content and often runs older, unpatched code. Anyone can find it.
- Put the staging site behind HTTP authentication or an IP allow-list, or delete it when the launch is done.
- At minimum switch on "Discourage search engines" there and add a noindex X-Robots-Tag header.
Questions people ask
What is a WordPress staging site?
It is a clone of your WordPress site, files and database, where you can test plugin, theme and core updates without risking the live site. Many hosts, such as SiteGround, WP Engine and Bluehost, create one with a click, and plugins such as WP Staging do it on any host. When the changes work, you push them to the live site or repeat them there.
How do I keep a staging site out of Google?
Put it behind a password, which is the only method that also keeps people and scrapers out. If you cannot, send noindex on every page, with an X-Robots-Tag: noindex header or a robots meta tag; in WordPress, tick "Discourage search engines from indexing this site". Do not rely on robots.txt alone: it stops crawling, but blocked URLs can still appear in results.
Should a staging site be password protected?
Yes. HTTP authentication or your host's built-in protection stops search engines, visitors and bots in one step, and it cannot be lost by copying settings from the live site. When you push changes from staging to live, make sure the staging noindex setting does not travel with them, or the live site can drop out of Google.