<p>Craft 4.11 (and 5.3) added <a href="https://github.com/craftcms/cms/discussions/15447" rel="nofollow noreferrer">a new behavior</a> where all URLs generated by Craft would have a <code>x-craft-preview</code> or <code>x-craft-live-preview</code> query param added, if the current request was a preview request (i.e. had a preview param in the original request URL).</p>
<p>A few people reported that – like in your case – Google et. al. had started picking up URLs with those preview params, presumably by GoogleBot having crawled a preview link/URL. Exacerbating the issue was the fact that <a href="https://github.com/craftcms/cms/issues/15586" rel="nofollow noreferrer">these preview URLs could end up in sites' template caches</a>, since Craft would potentially cache any request <em>with</em> a preview param, but <em>without</em> a token. These cached page views could even be eligible for indexing, since at the time, Craft also didn't set the <code>X-Robots-Tag: None</code> header unless there was a token in the URL in addition to a preview param.</p>
<p>Fortunately, Craft 4.12 and Craft 5.4 fixed these problems by</p>
<ul>
<li>Setting the <code>X-Robots-Tag: None</code> header for all preview requests</li>
<li>Disabling template caches for all preview requests</li>
<li>No longer adding preview query params to generated URLs, if their values are invalid</li>
</ul>
<p>My advice is to make sure your site is updated to Craft 4.12/5.4 or later, and this shouldn't be something to worry about anymore in most cases.</p>

CC BY-SA 4.0
2024-09-18T18:42:56.010Z
2024-09-18T19:28:04.660Z
2024-09-18T19:28:04.660Z
Mats Mikkel Rummelhoff
<p>I'm working on a website using CraftCMS and got a warning from GSC saying pages were &quot;Blocked due to access forbidden (403)&quot;</p>
<p>That never happened before, so I went to check and noticed that it started a couple of weeks ago
<a href="https://i.sstatic.net/wrhyGxY8.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/wrhyGxY8.png" alt="GSC screenshot" /></a></p>
<p>All of the pages have the &quot;?x-craft-preview=&quot; parameter, so I assume it is something from the CMS itself (don't know of any changes made from our side).</p>
<p>Anyone seen anything similar? Suggestions on how to resolve?</p>
<p>Thanks</p>

<config>
x-craft-preview pages being blocked due to access forbidden (403)
# x-craft-preview pages being blocked due to access forbidden (403)

(Asked by: username_0 on 2024-09-04)

I'm working on a website using CraftCMS and got a warning from GSC saying pages were "Blocked due to access forbidden (403)"

That never happened before, so I went to check and noticed that it started a couple of weeks ago
[![GSC screenshot](https://i.sstatic.net/wrhyGxY8.png)](https://i.sstatic.net/wrhyGxY8.png)

All of the pages have the "?x-craft-preview=" parameter, so I assume it is something from the CMS itself (don't know of any changes made from our side).

Anyone seen anything similar? Suggestions on how to resolve?

Thanks

**Tags:** config


---

## 1 answers

### Answer by username_1 on 2024-09-18. Score: 1

Craft 4.11 (and 5.3) added [a new behavior](https://github.com/craftcms/cms/discussions/15447) where all URLs generated by Craft would have a `x-craft-preview` or `x-craft-live-preview` query param added, if the current request was a preview request (i.e. had a preview param in the original request URL).

A few people reported that – like in your case – Google et. al. had started picking up URLs with those preview params, presumably by GoogleBot having crawled a preview link/URL. Exacerbating the issue was the fact that [these preview URLs could end up in sites' template caches](https://github.com/craftcms/cms/issues/15586), since Craft would potentially cache any request *with* a preview param, but *without* a token. These cached page views could even be eligible for indexing, since at the time, Craft also didn't set the `X-Robots-Tag: None` header unless there was a token in the URL in addition to a preview param.

Fortunately, Craft 4.12 and Craft 5.4 fixed these problems by

* Setting the `X-Robots-Tag: None` header for all preview requests
* Disabling template caches for all preview requests
* No longer adding preview query params to generated URLs, if their values are invalid

My advice is to make sure your site is updated to Craft 4.12/5.4 or later, and this shouldn't be something to worry about anymore in most cases.


---

