Search

# NOTE: An RSL license doc ships at /license.xml (open, attribution-friendly,
# consistent with the repo's MIT license) and a Content-Signal stance would be
# "search/ai-input/ai-train all welcome". Neither is advertised via robots.txt
# lines here: the RSL `License:` directive and the `Content-Signal:` line are
# non-standard robots.txt lines that Lighthouse's robots.txt validator
# rejects, which drops the SEO audit below 100 (a hard project constraint).
# License discovery instead ships as a Lighthouse-safe HTTP `Link:
# <.../license.xml>; rel="license"` response header on public/_headers.
# Content-Signal discovery has no such mechanism yet and stays deferred.

User-agent: *
Allow: /
# /login, /reset-password, /history, and query-string variants (?fbclid,
# ?utm_*, ?gclid) used to be Disallowed here for crawl-budget reasons. But
# /login, /reset-password, and /history already carry , and a Disallow stops a crawler from ever reaching that
# tag - it hides the noindex signal instead of letting it be honored. Crawl
# access is intentionally left open here so crawlers can read and honor it.

# --- AI crawler preferences (R23.8) ---
# Preference-signaling only, NOT an enforcement boundary. The interactive
# practice flows are client-rendered React islands, so their question content
# is never in the prerendered HTML a crawler sees regardless of these rules.
#
# Browse-mode citation crawlers (answer a user's live query, then cite us) are
# welcome on the full indexable surface (the LLM-citation flywheel).
User-agent: ChatGPT-User
Allow: /
User-agent: PerplexityBot
Allow: /
User-agent: Google-Extended
Allow: /

# 2026 citation/answer-engine crawlers: search-index and user-triggered fetch
# bots for AI answer engines (they browse or fetch on a user's live query,
# then cite us), same citation flywheel as above. None of these train models.
User-agent: OAI-SearchBot
Allow: /
User-agent: Claude-SearchBot
Allow: /
User-agent: Claude-User
Allow: /
User-agent: Perplexity-User
Allow: /
User-agent: Applebot
Allow: /

# Training-ingestion crawlers (they fetch pages to build model training data,
# not to answer a live query) may read the marketing/landing surface but we
# prefer they skip the interactive practice/auth shells (no useful prerendered
# content there anyway).
User-agent: GPTBot
Allow: /
Disallow: /login
Disallow: /reset-password
Disallow: /history
Disallow: /*/practice-exam
Disallow: /*/domain-practice

User-agent: ClaudeBot
Allow: /
Disallow: /login
Disallow: /reset-password
Disallow: /history
Disallow: /*/practice-exam
Disallow: /*/domain-practice

User-agent: CCBot
Allow: /
Disallow: /login
Disallow: /reset-password
Disallow: /history
Disallow: /*/practice-exam
Disallow: /*/domain-practice

Sitemap: https://www.cloudcertprep.io/sitemap.xml

# CloudCertPrep security disclosure policy (RFC 9116).
# Full policy, scope, and PII/auth-provider details: see SECURITY.md in the repo.
# The Expires date below is only a source-tree fallback; every build refreshes
# it in dist to now + 364 days (see scripts/update-security-txt-expires.mjs).
Contact: mailto:alex@cloudcertprep.io
Policy: https://github.com/nastaso/cloudcertprep/blob/main/SECURITY.md
Preferred-Languages: en
Canonical: https://www.cloudcertprep.io/.well-known/security.txt
Expires: 2027-08-05T08:52:19.129Z