Answers.Body: <p>So if you follow best practices, the <code>craft/</code> directory should just never be in the public webserver root to begin with. And if it's not, search engines are never going to be able to index it.</p>
  
  <p>The directories should look like this:</p>
  
  <p><code>
  craft/
  public/
  </code></p>
  
  <p>In other words, they are side by site, and Craft is never in the public web server directory.</p>
  
  <p>Craft's admin/login pages already send the <code>x-robots-tag: none</code> header, which tells Google et al not to index those pages. <a href="https://developers.google.com/search/reference/robots_meta_tag" rel="nofollow noreferrer">Learn More</a></p>
  
  <p><a href="https://i.sstatic.net/Wjxh2.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Wjxh2.png" alt="Craft Admin Login page"></a></p>
  
  <p>I've created many Craft sites over the years, all of them still have <code>/admin</code> as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks.</p>
  
  <p>Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the <code>craft/</code> directory out of the public root, follow the advice in <a href="https://nystudio107.com/blog/hardening-craft-cms-permissions" rel="nofollow noreferrer">Hardening Craft CMS Permissions</a> and sleep well at night. </p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-03-17T00:29:48.883Z
Answers.Text: Hi Andrew, Thanks for the reply, but I am talking about exposing the admin login page to potential security issues, like a brute force attack. So my concern is, even though I am using my own cp panel route via cptrigger, that it (the admin login page) gets indexed, thus exposing the website to potential brute force attacks. While this is a public website and there are no 100% guarantees nothing will compromise security, I am looking to mitigate this risk. Basically, I am looking for a way to add the robots noindex/nofollow meta to the admin pages.
Answers.UserDisplayName: Jon Krane
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-03-17T00:33:21.490Z
Answers.Text: @JonKrane If you're talking about a random bot coming along and finding your `/admin/login` page, I really wouldn't be too concerned about brute force attacks. Craft's admin/login pages already send the `x-robots-tag: none` header, which tells Google et al not to index those pages.
Answers.UserDisplayName: andrew.welch
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-03-17T00:35:36.940Z
Answers.Text: I've created many Craft sites over the years, all of them still have `/admin` as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks. Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the `craft/` directory out of the public root, follow the advice in [Hardening Craft CMS Permissions](https://nystudio107.com/blog/hardening-craft-cms-permissions) and sleep well at night. :)
Answers.UserDisplayName: andrew.welch
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-03-17T00:38:20.190Z
Answers.Text: Thank you, I will accept the x-robots-tag: none as answer. I was wondering how that was being done. (I can't upvote your answer yet though)
Answers.UserDisplayName: Jon Krane
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-03-17T00:41:21.387Z
Answers.Text: No worries, I amended my original reply with the info from the comments. Enjoy!
Answers.UserDisplayName: andrew.welch
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-03-17T00:06:14.170Z
Answers.LastActivityDate: 2018-03-17T00:40:39.630Z
Answers.LastEditDate: 2018-03-17T00:40:39.630Z
Answers.UserDisplayName: andrew.welch
Body: <p>I am trying to hide our website's admin directory from public view as best as possible and have read the <a href="https://craftcms.com/support/securing-craft" rel="nofollow noreferrer">Securing Craft</a> article. I am pleased at how easy it is to make a directory that isn't easy to guess using the cpTrigger setting in the config file. </p>
  
  <p>My next thought was to disallow the directory on the robot.txt file, keeping crawlers from indexing the login page. The obvious issue with that is that now the "hidden" admin directory is in public view from our robot.txt file, not exactly what I want to do.</p>
  
  <p>Is there something in the metatags or HTML of the Craft admin pages that blocks crawlers from indexing the admin pages? I was hoping to see the following on the admin pages:
      
  But they are not present. Is there a reason we would not want these by default on the Craft admin pages?</p>
  
  <p>Please advise on the best practice here, perhaps I am overthinking things, or there is another way altogether to accomplish this.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-03-16T23:54:06.237Z
Comments.Text: TLDR Do you have the craft folder in your document root? Generally speaking it's better to have it one level about that. The robots approach should work unless Google has already indexed it.
Comments.UserDisplayName: Mark Busnelli Jr
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-03-17T00:05:23.447Z
Comments.Text: Yes, followed everything advised on the Securing Craft webpage. The question is, does Craft have as a default, something that prevents crawlers from hitting the admin login and other pages in that directory? Seems like it should be in place already, maybe I am missing something?  BTW, it is possible, using the Google Webmaster tools to remove a previously indexed page.
Comments.UserDisplayName: Jon Krane
Tags: <admin><security>
Title: Hiding Craft's admin folder from search engines
ThreadText: # Hiding Craft's admin folder from search engines
  
  (Asked by: username_0 on 2018-03-16)
  
  I am trying to hide our website's admin directory from public view as best as possible and have read the [Securing Craft](https://craftcms.com/support/securing-craft) article. I am pleased at how easy it is to make a directory that isn't easy to guess using the cpTrigger setting in the config file.
  
  My next thought was to disallow the directory on the robot.txt file, keeping crawlers from indexing the login page. The obvious issue with that is that now the "hidden" admin directory is in public view from our robot.txt file, not exactly what I want to do.
  
  Is there something in the metatags or HTML of the Craft admin pages that blocks crawlers from indexing the admin pages? I was hoping to see the following on the admin pages:
  But they are not present. Is there a reason we would not want these by default on the Craft admin pages?
  
  Please advise on the best practice here, perhaps I am overthinking things, or there is another way altogether to accomplish this.
  
  **Tags:** admin, security
  
  > **Comments:**
  > **username_1**: TLDR Do you have the craft folder in your document root? Generally speaking it's better to have it one level about that. The robots approach should work unless Google has already indexed it.  
  > **username_0**: Yes, followed everything advised on the Securing Craft webpage. The question is, does Craft have as a default, something that prevents crawlers from hitting the admin login and other pages in that directory? Seems like it should be in place already, maybe I am missing something?  BTW, it is possible, using the Google Webmaster tools to remove a previously indexed page.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2018-03-17. Score: 2 | Accepted answer
  
  So if you follow best practices, the `craft/` directory should just never be in the public webserver root to begin with. And if it's not, search engines are never going to be able to index it.
  
  The directories should look like this:
  
  `craft/
  public/`
  
  In other words, they are side by site, and Craft is never in the public web server directory.
  
  Craft's admin/login pages already send the `x-robots-tag: none` header, which tells Google et al not to index those pages. [Learn More](https://developers.google.com/search/reference/robots_meta_tag)
  
  [![Craft Admin Login page](https://i.sstatic.net/Wjxh2.png)](https://i.sstatic.net/Wjxh2.png)
  
  I've created many Craft sites over the years, all of them still have `/admin` as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks.
  
  Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the `craft/` directory out of the public root, follow the advice in [Hardening Craft CMS Permissions](https://nystudio107.com/blog/hardening-craft-cms-permissions) and sleep well at night.
  
  > **Comments:**
  > **username_0**: Hi Andrew, Thanks for the reply, but I am talking about exposing the admin login page to potential security issues, like a brute force attack. So my concern is, even though I am using my own cp panel route via cptrigger, that it (the admin login page) gets indexed, thus exposing the website to potential brute force attacks. While this is a public website and there are no 100% guarantees nothing will compromise security, I am looking to mitigate this risk. Basically, I am looking for a way to add the robots noindex/nofollow meta to the admin pages.  
  > **username_2**: @username_0 If you're talking about a random bot coming along and finding your `/admin/login` page, I really wouldn't be too concerned about brute force attacks. Craft's admin/login pages already send the `x-robots-tag: none` header, which tells Google et al not to index those pages.  
  > **username_2**: I've created many Craft sites over the years, all of them still have `/admin` as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks. Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the `craft/` directory out of the public root, follow the advice in [Hardening Craft CMS Permissions](https://nystudio107.com/blog/hardening-craft-cms-permissions) and sleep well at night. :)  
  > **username_0**: Thank you, I will accept the x-robots-tag: none as answer. I was wondering how that was being done. (I can't upvote your answer yet though)  
  > **username_2**: No worries, I amended my original reply with the info from the comments. Enjoy!  
  
  ---
  
  