Answers.Body: <p>Craft 4.11 (and 5.3) added <a href="https://github.com/craftcms/cms/discussions/15447" rel="nofollow noreferrer">a new behavior</a> where all URLs generated by Craft would have a <code>x-craft-preview</code> or <code>x-craft-live-preview</code> query param added, if the current request was a preview request (i.e. had a preview param in the original request URL).</p>
  <p>A few people reported that – like in your case – Google et. al. had started picking up URLs with those preview params, presumably by GoogleBot having crawled a preview link/URL. Exacerbating the issue was the fact that <a href="https://github.com/craftcms/cms/issues/15586" rel="nofollow noreferrer">these preview URLs could end up in sites' template caches</a>, since Craft would potentially cache any request <em>with</em> a preview param, but <em>without</em> a token. These cached page views could even be eligible for indexing, since at the time, Craft also didn't set the <code>X-Robots-Tag: None</code> header unless there was a token in the URL in addition to a preview param.</p>
  <p>Fortunately, Craft 4.12 and Craft 5.4 fixed these problems by</p>
  <ul>
  <li>Setting the <code>X-Robots-Tag: None</code> header for all preview requests</li>
  <li>Disabling template caches for all preview requests</li>
  <li>No longer adding preview query params to generated URLs, if their values are invalid</li>
  </ul>
  <p>My advice is to make sure your site is updated to Craft 4.12/5.4 or later, and this shouldn't be something to worry about anymore in most cases.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-09-18T18:42:56.010Z
Answers.LastActivityDate: 2024-09-18T19:28:04.660Z
Answers.LastEditDate: 2024-09-18T19:28:04.660Z
Answers.UserDisplayName: Mats Mikkel Rummelhoff
Body: <p>I'm working on a website using CraftCMS and got a warning from GSC saying pages were &quot;Blocked due to access forbidden (403)&quot;</p>
  <p>That never happened before, so I went to check and noticed that it started a couple of weeks ago
  <a href="https://i.sstatic.net/wrhyGxY8.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/wrhyGxY8.png" alt="GSC screenshot" /></a></p>
  <p>All of the pages have the &quot;?x-craft-preview=&quot; parameter, so I assume it is something from the CMS itself (don't know of any changes made from our side).</p>
  <p>Anyone seen anything similar? Suggestions on how to resolve?</p>
  <p>Thanks</p>
  
Tags: <config>
Title: x-craft-preview pages being blocked due to access forbidden (403)
ThreadText: # x-craft-preview pages being blocked due to access forbidden (403)
  
  (Asked by: username_0 on 2024-09-04)
  
  I'm working on a website using CraftCMS and got a warning from GSC saying pages were "Blocked due to access forbidden (403)"
  
  That never happened before, so I went to check and noticed that it started a couple of weeks ago
  [![GSC screenshot](https://i.sstatic.net/wrhyGxY8.png)](https://i.sstatic.net/wrhyGxY8.png)
  
  All of the pages have the "?x-craft-preview=" parameter, so I assume it is something from the CMS itself (don't know of any changes made from our side).
  
  Anyone seen anything similar? Suggestions on how to resolve?
  
  Thanks
  
  **Tags:** config
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-09-18. Score: 1
  
  Craft 4.11 (and 5.3) added [a new behavior](https://github.com/craftcms/cms/discussions/15447) where all URLs generated by Craft would have a `x-craft-preview` or `x-craft-live-preview` query param added, if the current request was a preview request (i.e. had a preview param in the original request URL).
  
  A few people reported that – like in your case – Google et. al. had started picking up URLs with those preview params, presumably by GoogleBot having crawled a preview link/URL. Exacerbating the issue was the fact that [these preview URLs could end up in sites' template caches](https://github.com/craftcms/cms/issues/15586), since Craft would potentially cache any request *with* a preview param, but *without* a token. These cached page views could even be eligible for indexing, since at the time, Craft also didn't set the `X-Robots-Tag: None` header unless there was a token in the URL in addition to a preview param.
  
  Fortunately, Craft 4.12 and Craft 5.4 fixed these problems by
  
  * Setting the `X-Robots-Tag: None` header for all preview requests
  * Disabling template caches for all preview requests
  * No longer adding preview query params to generated URLs, if their values are invalid
  
  My advice is to make sure your site is updated to Craft 4.12/5.4 or later, and this shouldn't be something to worry about anymore in most cases.
  
  
  ---
  
  