robots.txt file
The file at /robots.txt that tells crawlers which addresses they may fetch and where the sitemap is. A rule that disallows the home page hides the whole site from search.
robots.txt is a plain-text file at the root of the site that well-behaved crawlers read before anything else. It holds User-agent groups with Disallow and Allow rules, and Sitemap: lines that point to your sitemaps. It controls crawling, not indexing: a disallowed page can still appear in results if other sites link to it. To keep a page out of the index, use noindex instead.
How SiteScan checks it
The scanner fetches /robots.txt and evaluates the rules the way Google and Bing do: the longest matching rule wins, and Allow beats Disallow at equal length.
- Red, "Blocks crawlers": the rules for all crawlers (
User-agent: *) disallow the page the scan started from, usually the home page. That hides the site from search. - Green: the file exists; the value is its size.
- Amber, "Missing": no file. Crawlers then assume everything is allowed, but you lose the place to declare the sitemap.
A server error, a refusal (401, 403, 429) or an HTML error page is not treated as a missing file; the row says "Not checked".
A safe starting point
User-agent: *, an empty Disallow: and Sitemap: https://example.com/sitemap.xml, one per line. A leftover Disallow: / from a staging site is the most common cause of a red row. More in robots.txt and sitemaps; see also CSS and JS for crawlers.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Indexing”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data