The standard behind robots.txt

IETF and the Robots Exclusion Protocol

RFC 9309 defines how compliant crawlers interpret robots.txt. It is a crawl-coordination standard, not access control, authentication or a ranking mechanism.

Published 2026-07-22Last reviewed 2026-07-22Primary-source analysis
What the RFC standardizes

Groups, rules, matching, errors and caching

The Robots Exclusion Protocol uses user-agent groups and allow or disallow path rules. RFC 9309 defines how crawlers select matching groups, compare paths, resolve equivalent rules and handle the robots file under different server responses.

Standardization reduces ambiguity among compliant crawlers. It does not require every automated client to obey the file.

The security distinction

A disallow rule does not protect a secret

The RFC states that robots rules are not a form of access authorization. The file is public and the blocked path can still be visible within it. Sensitive material requires authentication, permissions and server-side controls.

This is one of the most important technical distinctions on the site: crawl preference and security policy are not interchangeable.

Matching principles

The most specific applicable path wins

Error handling

The server response changes expected behaviour

The protocol distinguishes successful retrieval, redirects, unavailable resources and server errors. Operational teams should understand those differences rather than assuming a missing robots file and a 5xx failure communicate the same instruction.

Hidden Radius implementation rule

Use robots.txt as one layer

  1. Set the intended crawl policy.
  2. Verify the public file after deployment.
  3. Test the actual page response for the crawler.
  4. Inspect CDN and WAF rules.
  5. Use authentication for private material.
  6. Monitor logs for expected and unexpected automated access.
Source trail

Primary material behind this analysis

Related reading

Continue through the discovery stack