robots.txt control flow diagram showing user agents, allow and disallow directives, and sitemap declaration
Technical SEO

robots.txt for SEO in 2026: A Disciplined Guide

What robots.txt actually does in the AI-search era — the syntax that crawlers honour, how to control AI crawlers without breaking search, the patterns we ship on real client sites, and the verification routine that keeps you out of trouble.

11 min read
·
1,520 words
·
Updated April 26, 2026
·By Martin Vassilev, Toronto SEO

What robots.txt actually does (and what it does not)

robots.txt is a 30-year-old protocol with one job: tell well-behaved crawlers which URLs they may and may not fetch from your origin. It is fetched once per origin per session by compliant crawlers, parsed line-by-line, and honoured on a best-effort basis. Two things robots.txt does not do, in 2026 as in 1996: it does not remove URLs from search-engine indexes, and it does not stop non-compliant crawlers from fetching anything they want.

The persistent confusion is the difference between crawl control (what robots.txt does) and indexing control (what robots.txt does not do). A page disallowed in robots.txt that has external links pointing at it can still appear in Google with a generic snippet. The only way to remove it from the index is to allow crawl, serve a noindex directive, and wait for the crawler to fetch and process the noindex. Robots.txt alone does not get you there.

The 2026 syntax that crawlers honour

The full syntax that Googlebot honours is small. Anything beyond it is unsupported and silently ignored.

DirectiveHonoured byNotes
User-agent: All compliant crawlersMatch is exact (case-insensitive) for the agent string. Wildcard '*' matches any agent.
Disallow: All compliant crawlersPath is matched as a prefix from the root, with '*' wildcard and '$' end-of-line anchors.
Allow: Most compliant crawlers (incl. Google, Bing)Used to carve exceptions out of a broader Disallow. Most-specific match wins.
Sitemap: All major search engines and most AI crawlersAbsolute URL. Multiple Sitemap lines allowed; one per sitemap or sitemap index.
Crawl-delay: Bing, Yandex (NOT Google)Google ignores. Set crawl rate in Search Console for Google.
Host: Yandex onlyLong deprecated for Google. Safely omit.
Noindex: Nothing in 2026Removed from Google parsing in 2019. Use meta robots or X-Robots-Tag instead.

Wildcards: * matches any sequence of characters, $ anchors to the end of the URL. So Disallow: /*?session=$ blocks any URL ending in ?session= with no value, and Disallow: /*.pdf$ blocks every URL ending in .pdf.

Controlling AI crawlers without breaking search

The AI crawler landscape changed everything about how publishers think about robots.txt. There is now a meaningful distinction between training crawlers (which fetch your content to train future models) and live-mode crawlers (which fetch your content in real time when a user asks an AI engine a question and the engine browses the web for an answer). Most publishers we work with want different policies for each.

User agentOperatorPurposeTypical recommendation
GPTBotOpenAITrainingBlock to opt out of training; allow to opt in
ChatGPT-UserOpenAILive browsing for ChatGPT usersAllow if you want citations in ChatGPT answers
OAI-SearchBotOpenAISearchGPT indexingAllow if you want SearchGPT visibility
ClaudeBotAnthropicLive browsingAllow for Claude citations; block if you want to be invisible
anthropic-aiAnthropicTraining (legacy/uncertain)Conservative publishers block
PerplexityBotPerplexityLive citation crawlingAllow if you want Perplexity citations
Perplexity-UserPerplexityUser-initiated fetchAllow
Google-ExtendedGoogleBard/Gemini training (separate from Googlebot)Block to opt out of Gemini training without affecting Search
GooglebotGoogleSearch indexAlways allow
BingbotMicrosoftBing search indexAlways allow
ApplebotAppleSpotlight/SiriAllow
Applebot-ExtendedAppleApple Intelligence trainingBlock to opt out without affecting Spotlight

The distinction between training and live-mode crawlers is the single most important nuance in modern robots.txt. Block the wrong one and you make yourself invisible to the place AI users actually arrive from.

— Martin Vassilev, Founder, Toronto SEO

robots.txt patterns by site type

Lean marketing site

Allow everything to Google, Bing, and live AI crawlers. Block training crawlers if the brand wants to opt out. List sitemap. Eight to fifteen lines, no facets to worry about.

Editorial publisher

Same baseline as a marketing site, plus Disallow on /print/, /amp/ if shipped, internal search results, and any tag/date archives noindexed by other means. Strongly consider blocking training crawlers.

Ecommerce

Disallow internal search results, Disallow most faceted-navigation parameter combinations, Allow the canonical clean category URLs. Disallow /cart/, /checkout/, /account/. List the canonical product sitemap.

SaaS marketing + app

Marketing site allows everything; app subdomain (app.example.com) Disallow: / on its own robots.txt to prevent crawl of authenticated surfaces.

Multi-language

Same allow rules across language directories. Sitemap line points at the index that includes all language sitemaps. No language-specific blocks.

Headless CMS preview environments

Per-environment robots.txt enforced at the CDN. Production allows; staging and preview Disallow: /. Verify per environment after every deploy.

The robots.txt mistakes we still see in 2026

  • Staging robots.txt shipping to production
    The single most damaging robots.txt mistake. A Disallow: / line ships, the entire site disappears from search. Add a deploy-time check that reads the production robots.txt and refuses the deploy if Disallow: / is present under User-agent: *.
  • Disallowing /wp-admin/ to 'protect WordPress'
    Harmless but wastes a line. WordPress already serves /wp-admin/ behind authentication and the URL is not indexable anyway. Trim if you are tidying.
  • Disallowing /assets/ or /static/ blocking CSS and JS
    Modern Google needs to fetch your CSS and JS to render the page. Blocking these breaks rendering, which can suppress ranking. Only block if you are absolutely certain crawlers do not need to render the page.
  • Using Disallow to try to remove a page from the index
    Does not work. The page may still appear with a thin snippet, the noindex directive cannot be discovered because crawl is blocked, and the page is stuck in this state until you allow crawl.
  • Blocking Googlebot to 'save crawl budget' on a small site
    Crawl budget concerns apply to sites with hundreds of thousands of URLs. On a 200-page marketing site, you do not have a crawl-budget problem.
  • Listing one Sitemap line that points to a missing or 404 sitemap
    Search Console will report a sitemap error. AI crawlers that follow the Sitemap line silently fail. Test the sitemap URL after every robots.txt edit.
  • Using robots.txt to block faceted parameters that are linked from internal navigation
    Wastes link equity flowing into URLs that are then disallowed. Better fix: stop linking the parameters internally, or canonicalize them, then optionally disallow.
  • Misordering Allow and Disallow assuming first-match wins
    Most-specific match wins, not first-match. Test in the Google robots.txt tester or the official robotstxt parser before shipping a complex rule.

How to verify your robots.txt is doing what you think

  • Fetch /robots.txt from your production origin in a private browser window. Confirm the file you expect.
  • Run the URL Inspection tool on a sample of pages in Search Console. Confirm 'Crawl allowed: Yes' for indexable pages and 'No' for intentionally blocked ones.
  • Use the open-source Google robots.txt parser locally to evaluate your file against a list of test URLs.
  • Check the Sitemap line points at a 200-OK XML response (or sitemap index) and that every URL listed in the sitemap is allowed in robots.txt.
  • If you have multiple subdomains (m., shop., blog., app.), fetch each one's robots.txt independently and verify the policy makes sense for that surface.
  • Set a deploy-time guard: refuse any deploy where the production robots.txt contains Disallow: / under User-agent: *.
  • Re-run after every infrastructure change — CDN migration, host change, Cloudflare WAF rule edits can all silently change what /robots.txt returns.

The honest summary

robots.txt is small, simple, and high-stakes. The syntax is narrow; the failure modes are wide. In 2026 the file does double duty as your AI-crawler policy and your search-crawler policy, and the two policies are genuinely different. Get the basics right (allow what you want indexed, list your sitemap, block staging), decide a deliberate AI-crawler policy, and verify after every deploy. Treat the file as production code, not as configuration — because that is exactly what it is.

Frequently Asked Questions

The robots.txt questions we get asked most often during audits.

Technical SEO audit

Worried your robots.txt might be quietly blocking what you want indexed?

We audit robots.txt as part of every technical engagement — production versus staging, AI crawler policy, sitemap discoverability, and a honest test of what is actually being fetched.