Skip to main content
← All articles
SEOPublished October 10, 20262 min read

Keep a Staging Website Out of Google

How a staging or dev copy gets indexed, and the noindex, password, and robots checks I use so it does not compete with the real site.

StagingSEOnoindexWordPress
On this page

A staging website is a copy for review. It becomes a problem when Google lists it next to the real domain. Visitors land on staging.client.com or an IP address, forms post to the wrong place, and the live site looks duplicated.

This happens more often than people admit, because someone shares the staging link in a public doc or the host enables directory indexing.

Why robots.txt is not enough

Disallow: / in robots.txt asks well-behaved crawlers not to crawl. It does not reliably keep a URL out of the index if another page links to it. A noindex rule, or a login wall, is what you want.

Use both:

  1. HTTP header X-Robots-Tag: noindex, nofollow on every staging response, or a meta robots noindex in the HTML.
  2. HTTP basic auth or the host’s password protection, so the copy is not a public website at all.

Password protection is the stronger control. Noindex is the backup for the days someone turns the password off to show a client.

WordPress specifics

  • Set the site to discourage search engines under Settings → Reading while it is on staging. Remember to turn that off on production after migration, or the live site stays invisible.
  • Do not leave the staging URL in wp_options (siteurl / home) after cutover.
  • Block staging. in the CDN or firewall if the hostname should never be public.

Search the live HTML for the staging hostname before you announce launch. One stylesheet or canonical still pointing at staging is enough to confuse the index.

What I check

curl -sI https://staging.example.com/ | grep -i robots

You want x-robots-tag: noindex or a 401 from basic auth. Then search Google for site:staging.example.com. Old URLs can linger; use Search Console’s removal tool on the staging property if one exists, and keep the noindex in place so they do not return.

Production is the opposite

The live site should not send noindex on pages you want found. I have inherited launches where the “discourage search engines” checkbox survived the migration. If a new site has no impressions after a few weeks, that checkbox is the first place I look.

WhatsApp