When Google cannot see your app at all
Two settings that make a working site invisible. Both are free to check, forever.
noindex left on
A <meta name="robots" content="noindex"> tag, or an X-Robots-Tag: noindex header, tells every search engine to leave your app out of results entirely.
It is almost always left over from development. Nothing visibly breaks, so people discover it months later while wondering why they have no organic traffic.
If you need it for a staging environment, make it conditional on the environment rather than present in the code.
robots.txt blocking everything
A Disallow: / under User-agent: * blocks every crawler from every page. Same effect, different file.
User-agent: * Allow: / Disallow: /api/ Sitemap: https://yourdomain.com/sitemap.xml
And robots.txt is public
Listing a secret path in robots.txt does not hide it — it publishes it, in a file that is one of the first things anyone fetches. Crawlers obey the file; people do not have to.
To keep something out of search AND out of sight, use authentication plus a noindex tag on that page. Never a robots.txt entry.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site