sus.botdocs

Security finding

A staging or test host of the site shows up in Google search

Security Error Severity: High

Part of the audit Information exposure. Finding id: security.stagingHostInSearch.

What it costs you

Visitors can land on an unfinished copy of the site, and unreleased pages, prices or test data are public. The copy also competes with the real site in search.

What to do

Put the staging host behind a login or an IP allowlist, then ask Google to remove its pages with the Removals tool in Search Console.

What it checks

  • Test site shows up in search results

How to fix it

Put the staging host behind a password in nginx

    How to check: curl -sI https://[group key]/ shows status 401.

    Put the staging host behind a password in Apache

      How to check: curl -sI https://[group key]/ shows status 401.

      Close the staging host and remove it from search

      1. Protect [group key] with a login or an IP allowlist. A noindex tag alone keeps the content public.
      2. In Search Console, request removal of the host's pages with the Removals tool.

      How to check: Wait for the next Search Console update: the host's pages have no impressions.