# SMONK robots policy.
# Goal: let search engines index public content; block admin, secrets,
# upload directories, and every API/handler endpoint that returns JSON
# or processes form input. Audit E.2.

User-agent: *
Allow: /

# Internal areas
Disallow: /admin/
Disallow: /cron/
Disallow: /includes/
Disallow: /uploads/
Disallow: /vendor/
Disallow: /tools/

# Hidden files / dotfiles never to expose
Disallow: /.env
Disallow: /.env.example
Disallow: /.git/
Disallow: /.htaccess
Disallow: /.claude/

# Legacy / superseded pages
Disallow: /glossary-legacy.php

# Outbound-click redirector for aggregated jobs — a 302, nothing to index
Disallow: /go.php
Disallow: /go

# AJAX/API/handler endpoints — JSON responses, not for indexing
Disallow: /*-api.php
Disallow: /*-handler.php
Disallow: /api-*.php
Disallow: /ai-*.php
Disallow: /razorpay-webhook.php
Disallow: /save-profile.php
Disallow: /upload-resume.php
Disallow: /cart-update-format.php
Disallow: /coupon-check.php
Disallow: /checkout-create.php
Disallow: /checkout-verify.php
Disallow: /subscribe.php

# Authenticated portal pages — no SEO value, prevents login wall in SERP
Disallow: /dashboard.php
Disallow: /profile.php
Disallow: /my-courses.php
Disallow: /orders.php
Disallow: /notifications.php
Disallow: /portal-jobs.php
Disallow: /saved-jobs.php
Disallow: /job-alerts.php
Disallow: /interview-prep.php
Disallow: /mock-test-attempt.php
Disallow: /account-export.php
Disallow: /account-delete.php
Disallow: /change-password.php
Disallow: /company-dashboard.php
Disallow: /company-login.php
Disallow: /company-register.php
Disallow: /company-forgot-password.php
Disallow: /company-reset-password.php

# Search results pages tend to dilute SEO equity if indexed
Disallow: /search.php?

Sitemap: https://smonk.in/sitemap.xml