Staging Site Blocker Checklist

# Staging Site Blocker Checklist

- Targets: 0
- Staging-like targets: 0
- Production-like targets: 0
- Required checks: 8
- Config snippets: 4

## Targets

## Checklist
- [ ] Password or access control: Put staging behind password protection, VPN, basic auth, or platform access controls.
- [ ] Staging robots.txt: Serve a staging-only robots.txt that disallows all crawlers.
- [ ] Meta robots noindex: Add noindex,nofollow to staging HTML pages as a second layer.
- [ ] X-Robots-Tag header: Send X-Robots-Tag: noindex, nofollow on HTML and file responses.
- [ ] Sitemap exclusion: Do not publish staging sitemap URLs or submit them to Search Console.
- [ ] Production canonical: Canonical staging pages to the matching production URL only when content parity is clear.
- [ ] Analytics exclusion: Exclude staging traffic from analytics, ads pixels, and conversion dashboards.
- [ ] Production deploy gate: Add a release checklist item to remove blockers only on production deploys.

## Config snippets

### robots
```
User-agent: *
Disallow: /

# Serve this robots.txt only on staging, preview, QA, and dev hosts.
```

### meta
```
<meta name="robots" content="noindex,nofollow,noarchive,nosnippet">
```

### header
```
X-Robots-Tag: noindex, nofollow, noarchive, nosnippet
```

### platform
```
// vercel.json
{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "X-Robots-Tag", "value": "noindex, nofollow, noarchive, nosnippet" }
      ]
    }
  ]
}
```