We make use of the robots.txt file to prevent Google (and other search spiders) from crawling certain pages/directories in our domain. Some of these directories/files are secret, meaning they aren't linked (except perhaps on other pages encompassed by the robots.txt file). Some of these directories/files aren't secret, we just don't want them indexed.If somebody browses directly to www.mydomain.com/robots.txt, they can see the contents of the robots.txt file. From a security standpoint, this is not something we want publicly available to anybody. Any directories that contain secure information are set behind authentication, but we still don't want them to be discoverable unless the user specifically knows about them.Is there a way to provide a robots.txt file but to have it's presence masked by John Doe accessing it from his browser? Perhaps by using PHP to generate the document based on certain criteria? Perhaps something I'm not thinking of? We'd prefer a way to centrally do it (meaning a <meta> tag solution is less than ideal).
Disallow robots.txt from being accessed in a browser but still accessible by spiders?
php;security;robots.txt
If you don't want something visible to the web, then don't make it visible. In your case, using robots.txt for excluding directories is security by non-obscurity. Instead of publicly saying Hey, there's the place with all the precious jewels and valuable metals, don't go in there!, just say nothing and simply do not advertise the presence of those directories at all.This take some discipline on your part, making sure that none of those directories are referred to in any way on your publicly accessible pages.Otherwise it's impossible to do so via robots.txt. If you make that a dynamically generated page based on the visitor, then what's to stop someone from setting their browser's user agent string to Googlebot and getting the full list of your excluded directories? There's no 100% reliable method of detecting who's at the other end of a connection - at best you can guess and hope for the best. And guessing just doesn't cut it when it comes to security.Password protected pages/direcotries can't be crawled, so those would be safe even if they're not explictly listed in the robots.txt for exclusion - Googlebot and its brethren won't have login credentials, so can't get into the pages to spider them.