# robots.txt - navoasset.com
# (ASCII only: this file is served as text/plain with no charset, so non-ASCII
#  characters render as mojibake in a browser.)
#
# The public marketing site is a handful of pages. Everything else is a logged-in
# application (118 admin routes, 27 owner, 23 tenant, 15 manager, 5 partner...).
# This file previously allowed everything, so Google crawled the whole application
# and reported 43 unindexable URLs - redirects to login, and 404s from routes that
# need an ID or a session. That wastes crawl budget and risks portal URLs surfacing
# in search results.
#
# Rule of thumb: if a page requires a login, Google should never fetch it.

User-agent: *

# --- Role portals and the application itself -------------------------------
Disallow: /admin
Disallow: /owner
Disallow: /tenant
Disallow: /manager
Disallow: /partner
Disallow: /vendor
Disallow: /employee
# SEO-W1: /portal is intentionally NOT Disallow'd. manifest.json sets it as the
# PWA start_url and the manifest is linked from every page, so Google finds it
# on every crawl. Blocking it produced a permanent "Blocked by robots.txt" entry.
# The login view now carries <meta name="robots" content="noindex,follow">, which
# lets Google fetch it, honour the noindex, and drop it cleanly.
Disallow: /notifications
Disallow: /handover
Disallow: /media
Disallow: /documents

# --- Auth endpoints --------------------------------------------------------
Disallow: /loginAuth
Disallow: /sendOtp
Disallow: /logout
Disallow: /processRoleSelection
#
# SEO-W1 (Aug 2026): /signin and /signup were Disallow'd here. That was the
# wrong tool. Both are 301 redirects to /portal, and blocking a URL stops
# Google from ever FETCHING it, which means it can never see the redirect and
# never consolidates the signal - the URL just sits in the index as "Blocked
# by robots.txt" forever. Let Google crawl them, read the 301, and drop them.

# --- User-uploaded files (tenant documents, KYC, agreements) ---------------
# These must never be indexed.
Disallow: /uploads/
Disallow: /writable/

# --- App noise -------------------------------------------------------------
Disallow: /tour/

# --- Legacy static theme ---------------------------------------------------
# SEO-W1: .htaccess exempts /user/ from the front controller, so Apache serves
# the old real-estate theme directly - 18 crawlable PHP pages with stale titles,
# no canonical tags, and links to files that do not exist. It is an entire
# second website competing with the real one. Blocked here as the immediate
# fix; the directory should be deleted from the deployment (see audit §8.3).
Disallow: /user/

# --- Explicitly public (left crawlable) ------------------------------------
#   /                    homepage
#   /about /contact /pricing /services /trust
#   /privacy /terms
#   /insights-*          evergreen guides
#   /insights/*          CMS articles
#
# SEO-W1: "Allow: /ownerreg" was removed. The comment here called it "a real
# landing page", but the only route is ownerreg/(:any) - a token-gated CRM
# link generated per lead by an admin. Bare /ownerreg has no route and 404s,
# so we were explicitly inviting Google to crawl a 404. Restore this line if
# and when a genuine public owner-registration landing page is built.

Sitemap: https://www.navoasset.com/sitemap.xml