User-agent: *
Allow: /

# AI search and answer crawlers (OAI-SearchBot, ChatGPT-User, GPTBot,
# PerplexityBot, ClaudeBot, Bingbot for Copilot, Google-Extended) are
# deliberately NOT blocked: being cited in AI answers is how buyers find us.
# The plain-text summary for them is /llms.txt. Marketing pages also carry
# noindex where they are not for buyers (/design-system, /welcome) rather
# than a Disallow here, so the directive can be read.

# App pages — never want indexed
Disallow: /auth
Disallow: /dashboard
Disallow: /account
Disallow: /history
Disallow: /portal
Disallow: /admin
Disallow: /review
Disallow: /beta
Disallow: /success
Disallow: /unsubscribe
Disallow: /api
Disallow: /api-access
# The first-party PostHog proxy (next.config.ts rewrites): analytics
# requests, never a page.
Disallow: /ingest

# Note: /firms is intentionally crawlable so Googlebot can fetch the
# noindex meta tag in app/firms/layout.tsx. Per GSC "Indexed, though
# blocked by robots.txt" finding 2026-05-05: an external link caused a
# stub URL to be indexed, and the robots.txt block prevented Google
# from reading the noindex directive that would remove it. Crawl-allow
# + noindex meta is the correct combination for de-indexing.

# Internal docs (keep /docs/api crawlable)
Disallow: /docs
Allow: /docs/api

# Cloudflare-injected paths we don't own and don't want indexed.
# (GSC saw /cdn-cgi/l/email-protection 404 from a Cloudflare email
# obfuscation widget on a stale link.)
Disallow: /cdn-cgi/

# Note: /_next/static/ is intentionally NOT disallowed. Googlebot needs
# JS/CSS to render the SPA hydration layer — even though Next.js SSR
# produces fully-populated HTML, blocking the static path can cause
# rendering anomalies on second-pass indexing.

Sitemap: https://invoiceparserpro.com/sitemap.xml