We choose controls by the problem they solve. Robots.txt manages crawler access; noindex manages indexing when the crawler can read it; canonical consolidates duplicate signals; redirects move users and crawlers; authentication protects private content.
Robots.txt answers a crawl question
User-agent: *
Disallow: /internal-search/
This can reduce crawler access to a path, but it is not a reliable request to remove a URL from search results. A URL may still be discovered through links or historical signals.
Meta robots answers an indexing question
For public HTML that can be crawled but should not appear in search, we use:
<meta name="robots" content="noindex">
The crawler must be able to fetch the page to see the directive. Blocking the same URL in robots.txt can prevent that processing.
X-Robots-Tag handles response-level indexing
For PDFs and other non-HTML resources, or when headers are easier to manage centrally, X-Robots-Tag can carry noindex in the HTTP response:
X-Robots-Tag: noindex
Again, the crawler needs access to the response.
Canonical is not a removal command
A canonical link is a consolidation signal for duplicate or near-duplicate pages. We do not use it as a privacy control or as a guaranteed substitute for noindex. If an obsolete URL should permanently move, a redirect may be clearer.
Authentication is the privacy boundary
If content must be private, we use authentication, authorization, or network restrictions. Robots.txt is publicly readable, and noindex still assumes the resource is accessible to a crawler. Neither is a security mechanism.
We use a decision sequence
- private or sensitive → authentication;
- public but must stay out of search →
noindexorX-Robots-Tagwhile crawlable; - duplicate content → canonical, redirects, or URL cleanup;
- crawl waste → consider robots.txt after checking indexing/rendering side effects;
- crawler-specific policy → a targeted robots.txt user-agent group.
For a deeper indexing example, see robots.txt vs noindex.
We verify both layers after deployment
We fetch the live robots.txt with the checker, inspect the rendered HTML or HTTP headers, and test representative URLs with the tester. A correct source file is not enough if a CDN, framework, or CMS serves something different.
Keeping these controls separate prevents the common failure where robots.txt blocks the crawler that was supposed to read a noindex instruction.