Robots.txt

The standard was proposed by Martijn Koster, when working for Nexor in February 1994 on the www-talk mailing list, the main communication channel for WWW-related activities at the time. Charles Stross claims to have provoked Koster to suggest robots.txt, after he wrote a badly behaved web crawler that inadvertently caused a denial-of-service attack on Koster's server. The standard, initially RobotsNotWanted.txt, allowed web developers to specify which bots should not access their website or which pages bots should not access. The internet was small enough in 1994 to maintain a complete list of all bots; server overload was a primary concern. By June 1994 it had become a de facto standard; most complied, including those operated by search engines such as WebCrawler, Lycos, and AltaVista. On July 1, 2019, Google announced the proposal of the Robots Exclusion Protocol as an official standard under Internet Engineering Task Force. A proposed standard was published in September 2022 as RFC 9309. ==Standard==

A site owner wishing to give instructions to web robots places a text file called in the root of the web site hierarchy (e.g. ). This text file contains the instructions in a specific format (see examples below). Robots that choose to follow the instructions try to fetch this file and read the instructions before fetching any other file from the website. If this file does not exist, web robots assume that the website owner does not wish to place any limitations on crawling the entire site. A robots.txt file contains instructions for bots indicating which web pages they can and cannot access. Robots.txt files are particularly important for web crawlers from search engines such as Google. A robots.txt file on a website will function as a request that specified robots ignore specified files or directories when crawling a site. This might be, for example, out of a preference for privacy from search engine results, or the belief that the content of the selected directories might be misleading or irrelevant to the categorization of the site as a whole, or out of a desire that an application only operates on certain data. Links to pages listed in robots.txt can still appear in search results if they are linked to from a page that is crawled. A robots.txt file covers one origin. For websites with multiple subdomains, each subdomain must have its own robots.txt file. If had a robots.txt file but did not, the rules that would apply for would not apply to . In addition, each URI scheme and port needs its own robots.txt file; does not apply to pages under or . ==Compliance==

The robots.txt protocol is widely complied with by bot operators. where eBay attempted to block a bot that did not comply with robots.txt, and in May 2000 a court ordered the company operating the bot to stop crawling eBay's servers using any automatic means, by legal injunction on the basis of trespassing. In 2007, Healthcare Advocates v. Harding, a company was sued for accessing protected web pages archived via The Wayback Machine, despite robots.txt rules that prevented those pages from being archived. A Pennsylvania court ruled "in this situation, the robots.txt file qualifies as a technological measure" under the DMCA. Due to a malfunction at Internet Archive, Harding could temporarily access these pages from the archive and thus the court found "the Harding firm did not circumvent the protective measure". In 2013 Associated Press v. Meltwater U.S. Holdings, Inc. the Associated Press sued Meltwater for copyright infringement and misappropriation over copying of AP news items. Meltwater claimed that they did not require a license and that it was fair use, because the content was freely available and not protected by robots.txt. The court decided in March 2013 that "Meltwater’s copying is not protected by the fair use doctrine", mentioning among several factors that "failure […] to employ the robots.txt protocol did not give Meltwater […] license to copy and publish AP content". Search engines Some major search engines following this standard include Ask, AOL, Baidu, Bing, DuckDuckGo, Kagi, Google, Yahoo!, and Yandex. Archival sites Some web archiving projects ignore robots.txt. Archive Team uses the file to discover more links, such as sitemaps. Co-founder Jason Scott said that "unchecked, and left alone, the robots.txt file ensures no mirroring or reference for items that may have general use and meaning beyond the website's context." In 2017, the Internet Archive announced that it would stop complying with robots.txt directives. Artificial intelligence Starting in the 2020s, web operators began using robots.txt to deny access to bots collecting training data for generative AI. In 2023, Originality.AI found that 306 of the thousand most-visited websites blocked OpenAI's GPTBot in their robots.txt file and 85 blocked Google's Google-Extended. Many robots.txt files named GPTBot as the only bot explicitly disallowed on all pages. Denying access to GPTBot was common among news websites such as the BBC and The New York Times. In 2023, blog host Medium announced it would deny access to all artificial intelligence web crawlers as "AI companies have leached value from writers in order to spam Internet readers". In 2025, the nonprofit RSL Collective announced the launch of the Really Simple Licensing (RSL) open content licensing standard, allowing web publishers to set terms for AI bots in their robots.txt files. Participating companies at launch included Medium, Reddit, and Yahoo. ==Security==

Despite the use of the terms allow and disallow, the protocol is purely advisory and relies on the compliance of the web robot; it cannot enforce any of what is stated in the file. Malicious web robots are unlikely to honor robots.txt; some may even use the robots.txt as a guide to find disallowed links and go straight to them. While this is sometimes claimed to be a security risk, this sort of security through obscurity is discouraged by standards bodies. The National Institute of Standards and Technology (NIST) in the United States specifically recommends against this practice: "System security should not depend on the secrecy of the implementation or its components." In the context of robots.txt files, security through obscurity is not recommended as a security technique. ==Alternatives==

Many robots also pass a special user-agent to the web server when fetching content. A web administrator could also configure the server to automatically return failure (or pass alternative content) when it detects a connection using one of the robots. Some sites, such as Google, host a humans.txt file that displays information meant for humans to read. Some sites such as GitHub redirect humans.txt to an About page. Previously, Google had a joke file hosted at /killer-robots.txt instructing the Terminator not to kill the company founders Larry Page and Sergey Brin. ==Examples==

This example tells all robots that they can visit all files because the wildcard * stands for all robots and the Disallow directive has no value, meaning no pages are disallowed. User-agent: * Disallow: This example has the same effect, allowing all files rather than prohibiting none. User-agent: * Allow: / The same result can be accomplished with an empty or missing robots.txt file. This example tells all robots to stay out of a website: User-agent: * Disallow: / This example tells all robots not to enter three directories: User-agent: * Disallow: /cgi-bin/ Disallow: /tmp/ Disallow: /junk/ This example tells all robots to stay away from one specific file: User-agent: * Disallow: /directory/file.html All other files in the specified directory will be processed. Example demonstrating how comments can be used: • Comments appear after the "#" symbol at the start of a line, or after a directive User-agent: * # match all bots Disallow: / # keep them out This example tells one specific robot to stay out of a website: User-agent: BadBot # replace 'BadBot' with the actual user-agent of the bot Disallow: / This example tells two specific robots not to enter one specific directory: User-agent: BadBot # replace 'BadBot' with the actual user-agent of the bot User-agent: Googlebot Disallow: /private/ It is also possible to list multiple robots with their own rules. The actual robot string is defined by the crawler. A few robot operators, such as Google, support several user-agent strings that allow the operator to deny access to a subset of their services by using specific user-agent strings. A wildcard at the end of a rule in effect does nothing, as that is the standard behaviour. ==Nonstandard extensions==

Crawl-delay directive The crawl-delay value is supported by some crawlers to throttle their visits to the host. Since this value is not part of the standard, its interpretation is dependent on the crawler reading it. It is used when the multiple burst of visits from bots is slowing down the host. Yandex interprets the value as the number of seconds to wait between subsequent visits. Google ignores this directive, but provides an interface in its search console for webmasters, to control the Googlebot's subsequent visits. User-agent: bingbot Allow: / Crawl-delay: 10 Sitemap Some crawlers support a Sitemap directive, allowing multiple Sitemaps in the same robots.txt in the form Sitemap: full-url: Sitemap: http://www.example.com/sitemap.xml Universal "*" match The Robot Exclusion Standard does not mention the "*" character in the Disallow: statement. Content-Signal Cloudflare introduced Content-Signal as a directive to suggest acceptable crawler behavior by type, ai-train, ai-input, and search with values of yes or no for each. Content-Signal: ai-train=no, search=yes, ai-input=no ==Meta tags and headers==

In addition to root-level robots.txt files, robots exclusion directives can be applied at a more granular level through the use of Robots meta tags and X-Robots-Tag HTTP headers. The robots meta tag cannot be used for non-HTML files such as images, text files, or PDF documents. On the other hand, the X-Robots-Tag can be added to non-HTML files by using .htaccess and httpd.conf files. A "noindex" meta tag A "noindex" HTTP response header X-Robots-Tag: noindex The X-Robots-Tag is only effective after the page has been requested and the server responds, and the robots meta tag is only effective after the page has loaded, whereas robots.txt is effective before the page is requested. Thus if a page is excluded by a robots.txt file, any robots meta tags or X-Robots-Tag headers are effectively ignored because the robot will not see them in the first place. ==See also==