Complete Technical Guide to robots.txt & RFC 9309 Specification
The robots.txt file is a standardized plain-text document served from the root of a domain (e.g., https://example.com/robots.txt). It communicates instructions to automated web search crawlers, spiders, and indexing bots regarding which sections of a website they are allowed or disallowed to access. In 2022, the Internet Engineering Task Force (IETF) codified the protocol as RFC 9309 (Robots Exclusion Protocol), formally unifying parsing rules, pattern matching syntax, and directive precedence across all major search engines.
Although robots.txt is widely supported by compliant search engines like Google, Bing, and Yandex, it operates as a voluntary advisory standard. Having a robots.txt file is not strictly mandatory for a website to be indexed, but maintaining an accurate file is essential for controlling crawl budget, preventing search bots from overloading backend infrastructure, and steering crawlers toward authoritative canonical URLs.
1. Core Directives: User-agent, Disallow, Allow & Sitemap
A standard robots.txt consists of one or more directive blocks structured by specific crawler targets:
User-agent:Defines the target crawler for the rules that follow. UsingUser-agent: *establishes universal rules for all compliant crawlers. Target-specific rules can be set for dedicated engines, such asUser-agent: GooglebotorUser-agent: Bingbot.Disallow:Directs the bot not to crawl URLs matching the specified relative path prefix (e.g.,Disallow: /admin/). Leaving the field empty (Disallow:) explicitly permits crawling of all pages.Allow:Explicitly permits crawling of a specific sub-path located inside a broader disallowed folder (e.g.,Disallow: /wp-admin/followed byAllow: /wp-admin/admin-ajax.php).Sitemap:Declares the absolute URL of your XML sitemap (e.g.,Sitemap: https://example.com/sitemap.xml). You can specify multiple sitemaps to help search engines discover newly published pages. You can generate optimized sitemaps using our XML Sitemap Generator.
2. Crawling vs. Indexing: Why robots.txt is Not a noindex Mechanism
A frequent misconception in Technical SEO is treating Disallow as a de-indexing tool. Disallowing a URL only prevents search engines from crawling and downloading its contents. If the disallowed URL is linked internally or externally from other websites, Googlebot may still index the URL without fetching its HTML, displaying the URL in search results with a generic snippet stating "No information is available for this page".
If your goal is to completely remove a page from search results, you must allow Googlebot to crawl the page and output a <meta name="robots" content="noindex, follow"> tag or an X-Robots-Tag: noindex HTTP response header. You can configure and validate these tags with our Meta Tags Generator. Note that Google officially deprecated the proprietary Noindex: directive inside robots.txt in September 2019.
3. Directive Precedence & Pattern Matching (RFC 9309 §2.2.2)
Under the official RFC 9309 standard, search engines evaluate path rules using specific length matching:
- Longest Matching Path Wins: The crawler compares all applicable rules and enforces the one with the longest character count.
- Allow Precedence on Tie: When an
Allowrule and aDisallowrule match the exact same character length on a URL, theAllowdirective wins. - Wildcard (
*): Matches zero or more arbitrary characters (e.g.,Disallow: /*.pdf$). - End-of-path Anchor (
$): Signifies the strict end of a URL path, distinguishing/file.pdffrom query parameter variations like/file.pdf?download=1. - Case Sensitivity: Directives are case-sensitive.
Disallow: /Admin/will not block access to/admin/.
4. Technical Reality of Crawl-delay in Google, Yandex and Bing
The Crawl-delay directive is not part of the RFC 9309 core standard and is treated differently across search engines:
- Googlebot: Completely ignores Crawl-delay inside robots.txt. Google dynamically adapts its crawl rate based on server responsiveness or custom settings in Google Search Console.
- Yandex: Has officially ignored Crawl-delay for main search indexing since February 2018. Crawl speed for Yandex is configured inside Yandex Webmaster.
- Bingbot, AhrefsBot & SemrushBot: Fully recognize and honor
Crawl-delay(specified in seconds) to limit the frequency of requests to your server.
5. Specific Bots & Artificial Intelligence Crawlers
Modern websites often manage search engine crawlers alongside commercial SEO bots and AI data scrapers:
- Search Engines:
Googlebot,Bingbot,YandexBot,Baiduspider. - AI & LLM Crawlers:
GPTBot(OpenAI),CCBot(Common Crawl),ClaudeBot(Anthropic),Google-Extended(Gemini training). - SEO Tool Crawlers:
AhrefsBot,SemrushBot,DotBot.
You can audit bot accessibility and identify bot request behavior on your domain using our AI Bots & Crawler Checker.
6. Security Warning: robots.txt Does NOT Protect Confidential Content
robots.txt is a public document accessible to anyone on the internet. Never list secret folders, staging URLs, private API endpoints, or sensitive administrative URLs in robots.txt, as malicious actors systematically inspect robots.txt to discover hidden paths.
To protect private resources, always enforce server-side authentication (OAuth, password logins, session cookies, or firewall IP whitelists).
7. How to Test and Verify Your robots.txt File
Before deploying changes to production, verify your configuration with the following steps:
- Direct HTTP 200 Check: Open
https://yourdomain.com/robots.txtin your browser and confirm it loads as plain UTF-8 text. - Google Search Console: Use the robots.txt report and URL Inspection tool to confirm Googlebot has retrieved the latest version.
- Technical SEO Health: Audit your site for crawl issues, broken links, and structured data integrity using our Broken Link Checker and Schema JSON-LD Validator.
Practical Example
Allow all crawling, block /wp-admin/, allow admin-ajax.php, add sitemap
User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php
Sitemap: https://example.com/sitemap.xml
Blocks the administrative backend while ensuring Googlebot can render dynamic AJAX content required for page layout.
Block internal classes, sensitive checkout, search filters and cart
User-agent: *
Disallow: /classes/
Disallow: /config/
Disallow: /cart
Disallow: /search
Sitemap: https://example.com/sitemap.xml
Prevents crawler index bloat from duplicate faceted search results and cart URLs while keeping product catalog URLs crawlable.
Block PDF documents from crawling across all folders
User-agent: *
Disallow: /*.pdf$
The end-of-path anchor ($) ensures all URLs ending strictly in .pdf are blocked from crawling.