User-agent: *
Allow: /

# Conversion funnel + account surfaces — no crawl value (same rules as the
# production Next app so the cutover doesn't change Google's crawl profile)
Disallow: /checkout
Disallow: /charter/checkout
Disallow: /payment
Disallow: /booking
Disallow: /orders
Disallow: /my-profile
Disallow: /checkorder
Disallow: /api/

# /auth/ is DELIBERATELY crawlable — do not add it back. It was blocked here
# until 2026-08-10, and that block is precisely what got a login page indexed:
# GSC reported "Indexed, though blocked by robots.txt" for
# /ja/auth/login?return_url=/ja/fishing (first detected 8/8/26). The auth pages
# have carried <meta name="robots" content="noindex"> all along, but a blocked
# URL is never fetched, so Google never reads the noindex — it keeps the URL in
# the index, title-only, on the strength of the inbound link alone. A Disallow
# hides a page's CONTENT from Google; only a noindex Google is allowed to FETCH
# removes the URL. Crawl cost is negligible: the auth surface is four pages per
# locale, the navbar's login link is rel=nofollow (it carries the current page
# as ?return_url, so every page minted a unique blocked URL), and every response
# carries X-Robots-Tag: noindex from the Worker. /search stays blocked because
# its parameter space really is unbounded — different problem, different tool.

# …but NOT the read-only catalog reads the pages hydrate from. Google's renderer
# obeys robots.txt for SUBRESOURCES too, so `Disallow: /api/` meant Googlebot
# server-rendered a correct page, ran the client bundle, had its data fetch
# blocked, and rendered the template's not-found state OVER the good SSR content.
# Google then indexed that — which is why every destination/harbor/route/operator
# page came back "Soft 404" in the URL Inspection live test on 2026-07-28 while
# looking perfect in curl and in a real browser.
# Longest-match wins, so each Allow below overrides the /api/ Disallow above.
# These are anonymous catalog GETs; they carry X-Robots-Tag: noindex so the JSON
# itself is crawlable-for-rendering but never indexable. Everything else under
# /api/ — auth, orders, payments, forms, admin — stays blocked.
Allow: /api/destinations
Allow: /api/harbors
Allow: /api/routes
Allow: /api/operators
Allow: /api/articles
Allow: /api/comparisons
Allow: /api/charters
Allow: /api/fish
Allow: /api/dive-sites
Allow: /api/popular-tickets
Allow: /api/sailing
Allow: /api/currency

# Same funnel surfaces under every locale prefix (/id/ /ja/ /ko/ /zh/). robots
# Disallow is a prefix match, so `/checkout` does NOT cover `/id/checkout` — the
# localized funnel is served 200 and would otherwise be crawlable/indexable.
Disallow: /*/checkout
Disallow: /*/charter/checkout
Disallow: /*/payment
Disallow: /*/booking
Disallow: /*/orders
Disallow: /*/my-profile
Disallow: /*/checkorder
Disallow: /*/membership-tier

# Crawl budget: block pagination query crawl
Disallow: /*?page=

# Crawl budget: block the search results page and its infinite parameter space.
# `/search?departure_dock_id=…&arrival_dock_id=…&departure_date=…` is unbounded —
# GSC had 420 of these permutations queued and was still fetching them on
# 2026-07-24/25 while 220 sitemap URLs had never been crawled once. The page has
# always been `noindex, follow`, so nothing here was ever eligible to rank; the
# only thing the crawl bought was budget spent re-confirming a noindex.
# Keeping the on-page noindex as well, for anything that slips through a
# non-conforming crawler.
Disallow: /search
Disallow: /*/search

Host: https://sailtix.com
Sitemap: https://sailtix.com/sitemap.xml

# Crawl-delay for aggressive bots
User-agent: AhrefsBot
Crawl-delay: 10

User-agent: SemrushBot
Crawl-delay: 10