Q: To keep my staging/replatform site out of Google, should I use robots.txt or noindex?

Q: To keep my staging/replatform site out of Google, should I use robots.txt or noindex?

Very important to get right — picking wrong here can deindex your live site on launch day.

Short answer: protect staging with HTTP auth (password), not robots.txt or noindex.

Long answer:
robots.txt 'Disallow' blocks crawling but not indexing — Google can still list the URL. Worse, if a noindex tag is on the page, a robots block prevents Google from ever seeing that tag.

Meta noindex works on staging — but the real danger is forgetting to remove it at launch. Plenty of traffic disasters trace to a noindex shipped to production.

HTTP basic auth sidesteps both: bots can't reach the site at all, and there's no tag to accidentally carry over.

Next step: put staging behind a password, and add a launch-checklist item to grep your live templates for stray 'noindex' before go-live.