WordPress: Add to robots.txt to Prevent Google from Indexing wp-login.php and wp-admin

Gatsby

When running a WordPress website, especially one that’s publicly accessible, it’s crucial to control what content search engines are allowed to crawl and index. Two of the most commonly overlooked URLs are wp-login.php and the wp-admin dashboard. While these are essential for site management, they should never be indexed by search engines.

In this post, we’ll go over:

  • Why blocking wp-login.php and wp-admin/ is important
  • How to configure robots.txt manually
  • How to configure it using a WordPress SEO plugin like Yoast or Rank Math

Why Should You Block wp-login.php and wp-admin/ from Search Engines?

Search engines like Google index pages based on crawl accessibility. If you don’t explicitly block wp-login.php and wp-admin/, they could appear in search results. This can lead to several issues:

1. Security Risk

Having login pages indexed can increase brute-force attempts and bot scans. Disallowing them in robots.txt won’t stop all bots, but it helps reduce unnecessary exposure.

2. No SEO Value

These pages contain no content that’s valuable to search engine users. Indexing them provides no SEO benefit.

3. Wasted Crawl Budget

Every site has a limited “crawl budget”—the number of pages a search engine bot will crawl on your site. Letting bots crawl login/admin pages wastes resources that could be spent crawling your real content.

Aren’t These Pages Already Noindexed?

Yes — both wp-login.php and wp-admin/ already include a <meta name="robots" content="noindex,follow"> tag by default in WordPress. This instructs search engines like Google not to index these pages, and Google generally respects this directive.

However, even when a page has a noindex tag, Google may still show it in Google Search Console under the “Indexed, not submitted in sitemap” or “Excluded > Page with noindex tag” categories. This can clutter your reports and cause unnecessary confusion.

If you want to prevent even the appearance of these URLs in Search Console (under the “excluded” category), you can use robots.txt to block crawlers from accessing the pages altogether. This ensures Googlebot doesn’t fetch or report them at all.

How to Configure robots.txt to Block wp-login.php and wp-admin/

A robots.txt file is a simple text file placed at the root of your domain (e.g., https://example.com/robots.txt) that gives instructions to search engine crawlers.

✅ Recommended robots.txt Entries

User-agent: *
Disallow: /wp-login.php
Disallow: /wp-admin/

What This Does:

  • User-agent: * — Applies to all bots
  • Disallow: /wp-login.php — Blocks the login page and all query variations
  • Disallow: /wp-admin/ — Blocks all admin dashboard URLs

🛠️ Special Note:

If you rely on plugins or themes that use admin-ajax.php (like contact forms or AJAX-powered features), you should explicitly allow it:

Allow: /wp-admin/admin-ajax.php

How to Edit robots.txt in WordPress

Option 1: Manually via File Manager or FTP

  1. Use an FTP client or File Manager in your hosting control panel
  2. Navigate to the root directory of your WordPress install
  3. Create or edit the file named robots.txt
  4. Paste the recommended entries
  5. Save and verify it’s accessible at https://yourdomain.com/robots.txt

Option 2: Using Yoast SEO Plugin

  1. Go to SEO > Tools
  2. Click “File Editor”
  3. Add the recommended lines in the robots.txt box
  4. Save changes

Option 3: Using Rank Math

  1. Go to Rank Math > General Settings > Edit robots.txt
  2. Paste the recommended entries
  3. Save

Verify Your robots.txt

After saving, test the file using:
– Google Search Console robots.txt Tester
– Directly visiting https://yourdomain.com/robots.txt

Conclusion

Blocking wp-login.php and wp-admin/ in your robots.txt is a small yet effective SEO and security practice. It prevents search engines from wasting resources on non-public content, protects against unnecessary exposure of sensitive URLs, and optimizes your site’s crawl budget.

Even though these pages already include noindex meta tags, using robots.txt provides an additional layer of protection and helps keep your Google Search Console reports clean.

Whether you’re a WordPress beginner or a seasoned admin, taking this step strengthens your site’s structure in the eyes of both bots and users.

Related Posts