User-agent: *
Allow: /

# The versioned endpoint namespace only. Nothing under it renders, and a
# crawler walking POST endpoints just burns compute — but /api itself is the
# documentation, which is the one page here most worth reading, so the rule has
# to name /api/v1/ rather than /api/.
Disallow: /api/v1/

# Behind Cloudflare Access and noindex; kept out here as well.
Disallow: /admin

# Sign-in, and everything it can be pointed at.
#
# There is nothing to index on a login page, and it used to be an unbounded
# space: the header built /signin?next=<this page> on every page, including on
# sign-in itself, so each render nested another copy. Google renders JavaScript
# and followed it — 764 URLs, one of them four levels deep.
#
# The loop is fixed in accountLink.ts and refused again in nextPath.ts, so this
# rule is not what makes it safe. It is here because ?next= still produces one
# URL per page of the site, all of them the same login form, and none of them
# worth a crawl.
Disallow: /signin

# What this site is and what it can do, for something reading rather than
# browsing. The tool contracts are in openapi.json.
# https://helpyself.com/llms.txt
# https://helpyself.com/openapi.json

Sitemap: https://helpyself.com/sitemap.xml