# See https://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file

User-agent: *
Allow: /

# Sitemap locations
Sitemap: https://www.storeradar.io/sitemap.xml
Sitemap: https://www.storeradar.io/new-shopify-stores/sitemap.xml
Sitemap: https://www.storeradar.io/shopify-stores/sitemap.xml

# The API catalog (RFC 9727, /.well-known/api-catalog) points discovery clients at the
# OpenAPI document and the API docs page. Both live under /api/, which is Disallowed below
# to keep crawlers out of the authenticated endpoints, so they need explicit Allow rules:
# a catalog whose own links are robots-disallowed contradicts itself. Allow wins on
# longest-match for Google and Bing. Guarded by well_known/api_catalog_controller_test.
Allow: /api/docs
Allow: /api/v1/openapi.json

# Disallow admin and private areas
# /api/v1 only, NOT /api/. Blocking the whole prefix de-indexed /api/docs, which is
# the page the product wants found. The v1 endpoints stay blocked because they answer
# 401 to a crawler and that noise is what Search Console reported.
# public/ is served with a one-year CDN max-age: changing this file needs a manual
# Cloudflare purge to take effect. See docs/runbooks/rest-api-revival-release.md.
Disallow: /api/v1
Disallow: /madmin/
Disallow: /users/
Disallow: /accounts/
Disallow: /dashboard/
Disallow: /leads/
Disallow: /notifications/
Disallow: /integrations/
Disallow: /onboarding/
Disallow: /exports/
Disallow: /store_profiles/
Disallow: /discover/

# Faceted/sorted/paginated crawl traps. These variants are already noindexed
# (StaticController#homepage_has_params?) and have been de-indexed since Apr 2026,
# so blocking the crawl now just stops Googlebot re-fetching ~35k dead URLs and
# frees budget for the pSEO pages. Only the homepage's legacy table used these
# params; indexable pages (pSEO leaves, daily hub) key off path segments, and
# attribution params (utm_*, gclid, ref) are deliberately NOT blocked.
Disallow: /*?*sort=
Disallow: /*?*direction=
Disallow: /*?*page=