<p>So if you follow best practices, the <code>craft/</code> directory should just never be in the public webserver root to begin with. And if it's not, search engines are never going to be able to index it.</p>

<p>The directories should look like this:</p>

<p><code>
craft/
public/
</code></p>

<p>In other words, they are side by site, and Craft is never in the public web server directory.</p>

<p>Craft's admin/login pages already send the <code>x-robots-tag: none</code> header, which tells Google et al not to index those pages. <a href="https://developers.google.com/search/reference/robots_meta_tag" rel="nofollow noreferrer">Learn More</a></p>

<p><a href="https://i.sstatic.net/Wjxh2.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Wjxh2.png" alt="Craft Admin Login page"></a></p>

<p>I've created many Craft sites over the years, all of them still have <code>/admin</code> as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks.</p>

<p>Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the <code>craft/</code> directory out of the public root, follow the advice in <a href="https://nystudio107.com/blog/hardening-craft-cms-permissions" rel="nofollow noreferrer">Hardening Craft CMS Permissions</a> and sleep well at night. </p>

CC BY-SA 3.0
2018-03-17T00:29:48.883Z
Hi Andrew, Thanks for the reply, but I am talking about exposing the admin login page to potential security issues, like a brute force attack. So my concern is, even though I am using my own cp panel route via cptrigger, that it (the admin login page) gets indexed, thus exposing the website to potential brute force attacks. While this is a public website and there are no 100% guarantees nothing will compromise security, I am looking to mitigate this risk. Basically, I am looking for a way to add the robots noindex/nofollow meta to the admin pages.
Jon Krane
CC BY-SA 3.0
2018-03-17T00:33:21.490Z
@JonKrane If you're talking about a random bot coming along and finding your `/admin/login` page, I really wouldn't be too concerned about brute force attacks. Craft's admin/login pages already send the `x-robots-tag: none` header, which tells Google et al not to index those pages.
andrew.welch
CC BY-SA 3.0
2018-03-17T00:35:36.940Z
I've created many Craft sites over the years, all of them still have `/admin` as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks. Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the `craft/` directory out of the public root, follow the advice in [Hardening Craft CMS Permissions](https://nystudio107.com/blog/hardening-craft-cms-permissions) and sleep well at night. :)
andrew.welch
CC BY-SA 3.0
2018-03-17T00:38:20.190Z
Thank you, I will accept the x-robots-tag: none as answer. I was wondering how that was being done. (I can't upvote your answer yet though)
Jon Krane
CC BY-SA 3.0
2018-03-17T00:41:21.387Z
No worries, I amended my original reply with the info from the comments. Enjoy!
andrew.welch
CC BY-SA 3.0
2018-03-17T00:06:14.170Z
2018-03-17T00:40:39.630Z
2018-03-17T00:40:39.630Z
andrew.welch
<p>I am trying to hide our website's admin directory from public view as best as possible and have read the <a href="https://craftcms.com/support/securing-craft" rel="nofollow noreferrer">Securing Craft</a> article. I am pleased at how easy it is to make a directory that isn't easy to guess using the cpTrigger setting in the config file. </p>

<p>My next thought was to disallow the directory on the robot.txt file, keeping crawlers from indexing the login page. The obvious issue with that is that now the "hidden" admin directory is in public view from our robot.txt file, not exactly what I want to do.</p>

<p>Is there something in the metatags or HTML of the Craft admin pages that blocks crawlers from indexing the admin pages? I was hoping to see the following on the admin pages:
    
But they are not present. Is there a reason we would not want these by default on the Craft admin pages?</p>

<p>Please advise on the best practice here, perhaps I am overthinking things, or there is another way altogether to accomplish this.</p>

CC BY-SA 3.0
2018-03-16T23:54:06.237Z
TLDR Do you have the craft folder in your document root? Generally speaking it's better to have it one level about that. The robots approach should work unless Google has already indexed it.
Mark Busnelli Jr
CC BY-SA 3.0
2018-03-17T00:05:23.447Z
Yes, followed everything advised on the Securing Craft webpage. The question is, does Craft have as a default, something that prevents crawlers from hitting the admin login and other pages in that directory? Seems like it should be in place already, maybe I am missing something?  BTW, it is possible, using the Google Webmaster tools to remove a previously indexed page.
Jon Krane
<admin><security>
Hiding Craft's admin folder from search engines
# Hiding Craft's admin folder from search engines

(Asked by: username_0 on 2018-03-16)

I am trying to hide our website's admin directory from public view as best as possible and have read the [Securing Craft](https://craftcms.com/support/securing-craft) article. I am pleased at how easy it is to make a directory that isn't easy to guess using the cpTrigger setting in the config file.

My next thought was to disallow the directory on the robot.txt file, keeping crawlers from indexing the login page. The obvious issue with that is that now the "hidden" admin directory is in public view from our robot.txt file, not exactly what I want to do.

Is there something in the metatags or HTML of the Craft admin pages that blocks crawlers from indexing the admin pages? I was hoping to see the following on the admin pages:
But they are not present. Is there a reason we would not want these by default on the Craft admin pages?

Please advise on the best practice here, perhaps I am overthinking things, or there is another way altogether to accomplish this.

**Tags:** admin, security
> **Comments:**
> **username_1**: TLDR Do you have the craft folder in your document root? Generally speaking it's better to have it one level about that. The robots approach should work unless Google has already indexed it.  
> **username_0**: Yes, followed everything advised on the Securing Craft webpage. The question is, does Craft have as a default, something that prevents crawlers from hitting the admin login and other pages in that directory? Seems like it should be in place already, maybe I am missing something?  BTW, it is possible, using the Google Webmaster tools to remove a previously indexed page.  

---

## 1 answers

### Answer by username_2 on 2018-03-17. Score: 2 | Accepted answer

So if you follow best practices, the `craft/` directory should just never be in the public webserver root to begin with. And if it's not, search engines are never going to be able to index it.

The directories should look like this:

`craft/
public/`

In other words, they are side by site, and Craft is never in the public web server directory.

Craft's admin/login pages already send the `x-robots-tag: none` header, which tells Google et al not to index those pages. [Learn More](https://developers.google.com/search/reference/robots_meta_tag)

[![Craft Admin Login page](https://i.sstatic.net/Wjxh2.png)](https://i.sstatic.net/Wjxh2.png)

I've created many Craft sites over the years, all of them still have `/admin` as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks.

Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the `craft/` directory out of the public root, follow the advice in [Hardening Craft CMS Permissions](https://nystudio107.com/blog/hardening-craft-cms-permissions) and sleep well at night.

> **Comments:**
> **username_0**: Hi Andrew, Thanks for the reply, but I am talking about exposing the admin login page to potential security issues, like a brute force attack. So my concern is, even though I am using my own cp panel route via cptrigger, that it (the admin login page) gets indexed, thus exposing the website to potential brute force attacks. While this is a public website and there are no 100% guarantees nothing will compromise security, I am looking to mitigate this risk. Basically, I am looking for a way to add the robots noindex/nofollow meta to the admin pages.  
> **username_2**: @JonKrane If you're talking about a random bot coming along and finding your `/admin/login` page, I really wouldn't be too concerned about brute force attacks. Craft's admin/login pages already send the `x-robots-tag: none` header, which tells Google et al not to index those pages.  
> **username_2**: I've created many Craft sites over the years, all of them still have `/admin` as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks. Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the `craft/` directory out of the public root, follow the advice in [Hardening Craft CMS Permissions](https://nystudio107.com/blog/hardening-craft-cms-permissions) and sleep well at night. :)  
> **username_0**: Thank you, I will accept the x-robots-tag: none as answer. I was wondering how that was being done. (I can't upvote your answer yet though)  
> **username_2**: No worries, I amended my original reply with the info from the comments. Enjoy!  

---

