User-agent: *

Allow: /assets/*.css
Allow: /assets/*.js
Allow: /assets/*.png
Allow: /assets/*.jpg
Allow: /assets/*.svg
Allow: /assets/*.woff2
Allow: /_r/
Allow: /upload/*.jpg
Allow: /upload/*.png
Allow: /upload/*.webp

Disallow: /api/
Disallow: /interface/
Disallow: /interfacemerchant/
Disallow: /partnerapi/
Disallow: /chatapi/
Disallow: /apibooking/
Disallow: /apilocations/
Disallow: /protected/
Disallow: /framework/
Disallow: /runtime/
Disallow: /deploy/
Disallow: /plans/
# NOTE: The admin/merchant backoffice path is INTENTIONALLY NOT listed here.
# robots.txt is publicly readable (curl /robots.txt) — listing the obfuscated
# admin path would defeat the whole point of giving it a random suffix and
# would hand attackers a clean target list. The backoffice is protected by:
#   1. X-Robots-Tag: noindex,nofollow,noarchive,nosnippet (Apache header)
#   2. <meta name="robots" content="noindex,..."> on every layout
#   3. Login wall (admin authentication)
#   4. NOT linked from any public page
# Google honours the X-Robots-Tag even without a Disallow line, so noindex
# behaviour is preserved while the path stays unadvertised.
# Block bare action names that some inline-JS variables expose to crawlers
# (these are POST endpoints that 404 on GET and were ending up in GSC's
# "Not found" report). Cross-reference: GSC Coverage 2026-05-03.
Disallow: /TransactionInfo
Disallow: /submitFeedback
Disallow: /uploadFeedbackImage
Disallow: /uploadaudio
Disallow: /addReview
Disallow: /uploadReview
Disallow: /PlaceOrder
Disallow: /applycancelorder
# Block authenticated/account flows from being crawled — they require
# login and have no SEO value, but were being listed in 404 reports
# because Google followed inline-JS hints to them.
Disallow: /account/orders
Disallow: /account/checkout
Disallow: /account/profile
Disallow: /account/wallet
Disallow: /account/addresses

# Crawl-delay removed (June 2026 SEO audit): Google ignores it anyway and
# Bing/other engines slow their crawl to 1 req/s — on a 640-URL site this
# needlessly stretches full recrawls with no server-load benefit.

Sitemap: https://speisedeal.de/sitemap.xml