#
# Hello bot! There are some routes that need authentication. You should avoid them :)
#
# Note: every app route is prefixed with a language segment (/en or /de), so the
# patterns below are written against both. Un-prefixed requests redirect to a
# prefixed URL, so they are covered by the wildcard patterns as well.
#

User-agent: *
Disallow: /en/profile-settings
Disallow: /en/l/new
Disallow: /en/l/*/checkout
Disallow: /en/l/*/draft
Disallow: /en/l/*/pending-approval
Disallow: /en/l/*/new
Disallow: /en/l/*/edit
Disallow: /en/inbox
Disallow: /en/order
Disallow: /en/sale
Disallow: /en/listings
Disallow: /en/account
Disallow: /en/reset-password
Disallow: /en/recover-password
Disallow: /en/verify-email
Disallow: /en/confirm
Disallow: /en/preview
Disallow: /en/notfound
Disallow: /en/whatsapp-booking-action
Disallow: /en/u/*
Disallow: /en/p/impressum
Disallow: /en/p/agb
Disallow: /en/p/datenschutz

Disallow: /de/profile-settings
Disallow: /de/l/new
Disallow: /de/l/*/checkout
Disallow: /de/l/*/draft
Disallow: /de/l/*/pending-approval
Disallow: /de/l/*/new
Disallow: /de/l/*/edit
Disallow: /de/inbox
Disallow: /de/order
Disallow: /de/sale
Disallow: /de/listings
Disallow: /de/account
Disallow: /de/reset-password
Disallow: /de/recover-password
Disallow: /de/verify-email
Disallow: /de/confirm
Disallow: /de/preview
Disallow: /de/notfound
Disallow: /de/whatsapp-booking-action
Disallow: /de/u/*
Disallow: /de/p/impressum
Disallow: /de/p/agb
Disallow: /de/p/datenschutz

# Development/debug surfaces that must never be indexed.
Disallow: /styleguide
Disallow: /*/styleguide

# Note: duplicate URLs created by tracking params (utm_*, gclid, fbclid) and by
# map/bounds permutations on /s are handled with rel=canonical rather than being
# blocked here -- a blocked URL is never crawled, so its canonical is never seen.
# See canonicalRoutePath() in src/util/routes.js.

# PetalBot (Huawei Petal Search) renders pages with JavaScript, so every page it
# crawled also fired our analytics snippet: 53.2M elbwalker ingest calls in July
# 2026 -- 99.9% of all events, ~EUR 72/month of Cloud Run cost -- while sending
# us no meaningful traffic in return. It honours robots.txt but ignores
# Crawl-delay, so blocking it outright is the only lever available here.
# Crawlers that ignore robots.txt are handled client-side instead; see isBot()
# in src/analytics/isBot.js.
User-agent: PetalBot
Disallow: /

User-agent: AspiegelBot
Disallow: /

Sitemap: https://www.socialbnb.org/sitemap-index.xml