DEV Community

Cover image for robots.txt Wildcards: Test the URLs You Mean to Block
Uriel Bitton
Uriel Bitton

Posted on

robots.txt Wildcards: Test the URLs You Mean to Block

For Google’s robots.txt interpretation, test a rule against actual URL examples before deploying it. A path prefix, a folder boundary, and an end-of-URL marker select different sets. The pattern can be valid while still blocking pages you intended to keep available.

The practical task is to compare two lists: the URLs your crawl policy should cover and the URLs the rule actually matches. This walkthrough uses a fictional documentation site. Its examples illustrate Google’s documented matching behavior; they are not a live crawler experiment or a claim about every AI crawler.

Write the intended URL set first

Imagine a public docs site with a working area at /draft/, a useful published guide at /draft-guide, a standalone page at /draft, and a mixed-case legacy path at /Draft. The team wants Googlebot to avoid the working area while retaining the public guide. Writing “block draft pages” in a ticket leaves too much room for interpretation.

Name representative URLs and expected outcomes before choosing a pattern. Include at least one child in the working folder, one public page with a similar prefix, the folder’s bare path, a query-string variant, and a case variant. Add examples from the site’s actual inventory rather than assuming all routes follow a naming convention.

Separate the business reason from the matcher result. “This contains unfinished material” is a policy decision. “This path starts with the selected prefix” is a mechanical condition. If the two sets do not line up, changing the label on the ticket will not fix the rule.

A prefix does not imply a directory boundary

Google’s robots.txt specification documents case-sensitive path matching and gives prefix examples. A rule starting /draft can match /draft-guide as well as /draft/notes. Adding a trailing slash narrows the boundary: /draft/ covers descendants of that folder but does not match the bare /draft path.

In the fictional inventory, the broad prefix would catch the useful public guide. The folder form better matches the stated policy, but leaves a separate question about the bare path. The team must inspect what that path actually serves. It may be a public overview, a redirect, or another working page.

Do not add an exception just to rescue a poorly understood pattern. First decide whether the folder structure expresses the intended policy. A short rule is only helpful when its selected set is clear. One extra character can change that set more than several lines of explanatory comments.

An end marker changes query-string coverage

The same specification defines * as matching zero or more valid characters and $ as marking the end of a URL. Its extension examples show that a pattern ending in .php$ excludes a URL continuing with a query string. Apply that distinction carefully when adapting an extension pattern to another fictional file type.

For example, compare /*.csv$ with inventory entries /exports/sample.csv and /exports/sample.csv?download=1. The first ends in .csv; the second continues beyond it. A team that writes “all CSV exports” but tests only the first form has not checked its actual policy. Also include an uppercase extension if the site produces one.

These examples are useful precisely because they expose assumptions. Do you want every export route, only a literal suffix, or a particular folder? The answer determines the rule. Do not keep broadening a wildcard until a few positive examples match while ignoring the public URLs it would also capture.

Read the complete applicable rule group

A pattern is not the whole decision. Google chooses the applicable user-agent group and resolves competing rules according to its documented specificity rules. Its specification describes using the longest matching path and choosing the less restrictive rule when equally specific rules conflict. Review the actual applicable group before interpreting a single line.

For the fictional docs site, an old specific crawler group could make a newly edited general group irrelevant to the crawler being checked. Equally, another matching line might explain why a URL remains allowed. Record the chosen group and matching rules beside the example outcome so someone else can follow the conclusion.

Keep this review scoped. The article is about Google’s interpretation, and another service’s crawler may document different behavior or support. A successful check for one named crawler is not evidence that every answer engine can retrieve the page. Identify the crawler and its current documentation whenever you extend the policy review.

Keep the site boundary visible

Google’s specification limits a robots.txt file to the relevant host, protocol, and port. That means reviewing a file on the marketing site does not establish the policy on a separate docs host. Make the complete origin part of the review record, even when the rule examples show only paths.

In the fictional project, the production docs host and a preview host might contain similar folders. A reviewer who checks the preview file can get a convincing result for the wrong destination. Record the exact public robots.txt URL and the complete example URL before evaluating the pattern.

Also distinguish a path rule from a security control. Confidential working content needs appropriate access protection. A crawler instruction is not permission enforcement. Google’s documentation also warns that a disallowed URL can still appear in search without a content snippet. Do not describe a crawl restriction as a guaranteed removal or confidentiality mechanism.

Build a review sheet with positive and negative examples

Use a small table or plain list with four fields: complete URL, intended crawl outcome, matching rule, and reason. Keep the expected outcome separate from the result. Otherwise a reviewer can unconsciously rewrite the expectation to match the pattern already chosen.

For the working folder, add a child page that should be excluded and the similar public guide that should remain available. Include the bare folder name, a nested path, and query variations observed on the site. For an extension rule, add both the clean suffix and a URL that continues beyond it.

Ask another reviewer to inspect the negative examples first. They reveal accidental expansion that an all-positive sample can miss. Mark any untested route family explicitly. A dozen carefully chosen examples will not prove coverage of an unlimited URL space, but they can expose an incorrect boundary before the change reaches production.

Validate the deployed file, then observe separately

After an authorized change through your normal release process, reopen the actual public file. Confirm the origin, contents, applicable group, and intended pattern. A correct local review is not enough if a stale file, deployment rule, or different host serves another version.

Recheck the same URL inventory against the deployed policy. Keep the before and after records. If a relevant native search diagnostic is available to the verified site owner, use it for the specific URL and distinguish the tool’s report from your manual matching analysis. Do not claim a live test was performed merely because you read the file.

Then observe crawler and search behavior with the reporting your team actually has. A newly deployed rule does not by itself prove that a crawler has fetched it or that search presentation has changed. Avoid promising a fixed update time. Those observations belong beside the rule review, with their dates and limits clearly stated.

Connect the repair to the discovery problem

A robots.txt wildcard review is most useful when tied to a specific discovery failure. If an important public answer sits inside an accidentally excluded prefix, correcting that policy can remove a documented obstacle for the named crawler. It cannot guarantee that the page will be indexed, cited, or recommended.

Conversely, an AI answer omitting your brand is not enough to diagnose a wildcard problem. You need the relevant URL, the applicable policy, and evidence that this access path matters to the surface being tested. Keep content quality, product relevance, and retrieval access as separate questions.

Finish with a short handoff: what the rule was meant to cover, which examples caught the mistake, which boundary was chosen, and how the deployed file was checked. That record helps the next release avoid repeating the assumption. The goal is a crawl policy whose meaning is reviewable, with evidence proportionate to the claim you make about it.

Hey I'm Uriel Bitton. I write about SEO, AEO, GEO, and helping brands get found in AI answers.

Subscribe for practical ways to grow your brand's visibility in search and AI answers.

Explore HoneyWeRank for SEO and AI visibility.

Sources

Top comments (0)