Skip to content

How to keep staging and dev sites out of Google

Security1 min readFixes check wp-staging-indexable

A public staging copy competes with the live site and often runs old code. Password-protect it or add noindex everywhere.

Step by step, with screenshots: Directory listings and exposed files: .env, .git and backups →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • No public staging copy foundfail · −5 ptseffort S

Public staging copy

Why it matters. A staging or dev copy that Google can index competes with the live site for its own content and often runs older, unpatched code. Anyone can find it.

How to fix it.
  1. Put the staging site behind HTTP authentication or an IP allow-list, or delete it when the launch is done.
  2. At minimum switch on "Discourage search engines" there and add a noindex X-Robots-Tag header.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.