What are your thoughts on security of placing CMS-related folders in a robots.txt file?

[James-Distinction]

So I was just about to add a whole heap of CMS-related folders to my robots.txt file to exclude them from search, and thought "hey, I'm publicly telling people where my admin folders are"...surely that's not right?!

Should I leave them out of the robots.txt file, and hope for the best that they never get indexed? Should I use noindex meta data on every page?

What are people's thoughts?

Thanks,

James

PS. I know this is similar to lots of other discussions around meta noindex vs. robots.txt, but I'm after specific thoughts around the security aspect of listing your admin folders in a robots.txt file...

[AlanMosley]

surly your admin folders are secured?, it would not matter if someone knows where they are.

[RyanKent]

As a rule, you want to avoid using robots.txt files whenever possible. It does not consistently protect you from crawlers and when it does block crawlers it kills any PR on those pages.

If you can block those pages with a noindex tag, it would be a preferable solution.

With respect to security for a CMS site, it really needs to be a comprehensive effort. Many site owners take a couple steps and then have a false-sense of security. Here are a few thoughts:

• try the site address with /administrator after it to access Joomla and other sites

• try the site address or blog with /wp-admin/ after it to access Joomla sites

• make up a webpage and try accessing it to view the site's 404 page

• right-click on a page and choose View Page Source. Often you will see the name of the CMS clearly listed. Other times you will see clear clues such as /wp/ in folder names. Other times you will find unique extensions such as Yoast SEO which will give you an idea of the CMS

Once a bad guy knows which CMS is in use, they know the default folder structure and more. The point is it requires a lot more effort then most people realize to hide the CMS in use. I applaud your effort, but be very thorough about it. There is a lot more involved then simply covering your robots.txt file.

[sesertin]

I found three options for you: http://www.techiecorner.com/106/how-to-disable-directory-browsing-using-htaccess-apache-web-server/

I think if you do it with.htacces that is a folder specific file than nobody will be able to detect where admin contet is located.