Best method for blocking a subdomain with duplicated content

[KateWaite]

Hello Moz Community

Hoping somebody can assist.

We have a subdomain, used by our CMS, which is being indexed by Google. 
http://www.naturalworldsafaris.com/
https://admin.naturalworldsafaris.com/

The page is the same so we can't add a no-index or no-follow. 
I have both set up as separate properties in webmaster tools

I understand the best method would be to update the robots.txt with a user disallow for the subdomain - but the robots text is only accessible on the main domain. http://www.naturalworldsafaris.com/robots.txt Will this work if we add the subdomain exclusion to this file?

It means it won't be accessible on https://admin.naturalworldsafaris.com/robots.txt (where we can't create a file). Therefore won't be seen within that specific webmaster tools property.

I've also asked the developer to add a password protection to the subdomain but this does not look possible.

What approach would you recommend?

[KateWaite]

Many thanks for taking the time to reply.

Ryan - I am talking to CMS Source about these options; it's not possible with the current configuration but it looks like we may be able to change this with a bit of development work.

Sean - Thanks, I had considered the canonical, which would at least prevent a duplicate content issue although I think we need to take measures to stop this admin. subdomain being accessible which this won't help with.

Lynn - Thanks, I'll do that as an interim measure.

Thanks
Kate

[LynnPatchett]

HI,

If you have the subdomain set up in GWT then you could do a url removal request (Google Index -> Remove URLs). Just put in the root admin subdomain (ie https://admin.naturalworldsafaris.com/). This usually works pretty quickly and given your description will likely be the quickest way to drop admin urls that are showing up in the serps.

It is not an ideal solution and the tool will tell you that for permanent exclusion you should do it through your robots.txt file. in regards your question about that though - the robots.txt file for the subdomain has to be placed on the subdomain, adding the subdomain to the main domains robot.txt file wont work.

[MibuKotaro]

One alternative you could try is to place a while this is not as ideal as adding the noindex nofollow it could help tell Google that the admin is not the preferred domain.

[RyanPurkey]

That's very strange behavior for the admin portion of a site to not be behind password protection.  If the current developer is unable to do so, I'd ask around on that because if you block the admin portion via password protection, even if it's still indexed in Google it will rank much lower.

Are you able to contact someone at CMS Source to get some support?  That might help resolve this as well as provide guidance on getting the robots.txt uploaded and being able to add noindex to admin only.