User-agent: *
Allow: /

# Block internal/admin paths
#
# NOTE: /ajax/ is deliberately NOT listed. It was, until 2026-08-17, when GSC
# reported "Indexed, though robots.txt blocked". A Disallow stops crawling, not
# indexing: Google had discovered /ajax/signup.php, /ajax/report.php and
# /ajax/b2b_contact.php as form actions and rendered-JS fetch targets on
# /signup/, /sample-quiz/ and /business/, and because it could not fetch them it
# could never see a noindex either -- so they sat in the index URL-only with no
# way out. All 19 endpoints now send `X-Robots-Tag: noindex, nofollow`, which
# only works if Googlebot is allowed to request them. Same reasoning removed
# /settings and /signout (they now emit meta noindex via index.php).
Disallow: /api_x/
Disallow: /mailer/
Disallow: /repo/
Disallow: /atpl/
Disallow: /graph/
Disallow: /includes/
Disallow: /new/

# Block non-public modules
# (/signout, /settings and their ?mod= forms are handled by meta noindex now --
# see the note above.)
#
# 2026-08-27: last_subs, reg_stats, emails, questions, lessons_topics and
# lessons_edit_topic were DELETED -- they were reachable by anyone, not
# admin-only as this comment used to claim. Their Disallow lines are gone on
# purpose: those URLs now 404, and per the /ajax/ note above a blocked URL can
# never show Googlebot its 404. process_xyz is the public payment IPN endpoint;
# online_xyz and sts still exist but are now owner-only (uid==1).
Disallow: /index.php?mod=process_xyz
Disallow: /index.php?mod=online_xyz
Disallow: /index.php?mod=sts

# NOTE: /index.php?mod=… for public pages used to be Disallowed here.
# Those rules were removed on 2026-05-04 because .htaccess now 301-redirects
# them to the new clean URLs. Blocking them prevented Googlebot from seeing
# the redirects, leaving 241 indexed URLs stuck on 404. Keep them crawlable
# so the redirect chain can be followed; the canonical (clean) URL wins.

Sitemap: https://www.part66online.com/sitemap.xml