What is consider best practice today for blocking admins from potentially getting indexed

[david-217997]

What is consider best practice today for blocking pages, for instance xyz.com/admin pages, from getting indexed by the search engines or easily found.  Do you recommend to still disallow it in the robots.txt file or is the robots.txt not the best place to notate your /admin location because of hackers and such? Is it better to hide the /admin with an obscure name, use the noidex tag on the page and don't list in the robots.txt file?

[perfectweb]

Agreed with the above two answers. Use an obscure url and use meta tags to noindex/nofollow the pages.

I wouldn't worry too much about people finding your admin pages. You should already have security measures in place that prevent people from hacking your site or "guessing" your admin credentials. If you don't have these types of measures in place then I would recommend concentrating on these.

Some ideas of things to look at:

• Ensure pages do not allow SQL injection attacks
• Use complex usernames and passwords
• Stop people from entering the wrong username and password more than x times within y minutes (e.g. lock out the account either permanently or for a temporary time restriction)
• If someone tries to enter a username and password within a given period of time, prompt them with a captcha check to ensure no bots are trying to access the site
• Ensure passwords are changed regularly
• Set up an alerting system should incorrect credentials be entered
• Plus there are LOADS more things you should do

[Goetzman]

I agree with Nick, using robots.txt, meta, and obscure page url

[NickPateman81]

name='robots' content='noindex,nofollow' /> before the and mix that with an obscure page URL. It'll never get found.

What you could do with the robots.txt is disallow a directory like /admin/ but then have the login page @ domain.com/admin/obscure-login-url. If you do all of that then you're pretty damn safe in the knowledge that no one will ever find your login URL.

[Andy.Drinkwater]

One of my customers just has a page that is hidden from public view (www.url.co.uk/adminpage), no-indexed and isn't in the robots file and in 10 years, there has never been a hack attempt.