Question: Considering upgrade of CMS to latest version- the process may take anywhere from 2 to 4 weeks.

May suggest - we need to work on live server, what we have planned:

* take exact replica of site and move to a test domain, but on live server
* Block Google, Bing, Yahoo - `User-agent: Google Disallow: /`, `User-agent: Bing Disallow: /`, `User-agent: Yahoo Disallow: /` in *robots.txt*
* Will upgrade CMS and add functionality - will test the entire structure, check URLusing xenu and move on to configure the site on original domain

The process upgradation and new tools may take 2 to 4 weeks....

Concern is that despite blocking Google, Bing & Yahoo through 

```
   User agent disallow 

```

can still the URLof test site can be crawled by the search engines - if yes - it may hurt the original site as will read on as entire duplicate or is there any alternate way around.

Answer: 
You *must* make sure that this site is unavailable to search engines. The best way to do this is to put the entire dev site behind a login mechanism. [Basic Authentication](http://en.wikipedia.org/wiki/Basic_access_authentication) is the simplest and most effective way to do this. It makes it impossible for search engines to crawl but is easy for developers/users to access as they only need to enter a password once per visit.
John is correct about adding authentication. One alternative is to restrict the site to specific IPs (e.g. the IP of your office), and serve a 404 or 403 error to others.

Also, with regards to robots.txt, you should block *all* bots, which is much simpler:

```
User-agent: *
Disallow: /

```

Even if you only block via robots.txt, there is no downside for SEO. The test site will *not* be crawled. If any individual page has a link to it from elsewhere that page *may* be crawled but never the whole site.