User-agent: *
Disallow: /admin/
Disallow: /api/
Disallow: /account/
Disallow: /actions/
Disallow: /login/
Disallow: /signup/
Disallow: /reset-password/
Disallow: /verify/
Disallow: /verify-email/
Disallow: /debug/
Disallow: /match/
Disallow: /preferences/
Disallow: /premium/
Disallow: /ops/
Disallow: /health/
Disallow: /intake/
Disallow: /vdr/
Disallow: /search

# WordPress probes (commonly hit by bots)
Disallow: /wp-admin/
Disallow: /wp-login.php
Disallow: /wp-content/
Disallow: /wp-includes/
Disallow: /xmlrpc.php

# Common vulnerability probes
Disallow: /.env
Disallow: /.git/
Disallow: /config/
Disallow: /backup/
Disallow: /phpmyadmin/
Disallow: /phpinfo.php
# NOTE: /.well-known/ intentionally NOT disallowed — RFC 8615 standardized path
# used for ACME (Let's Encrypt SSL renewal), security.txt, OpenID discovery,
# Apple App Site Association. Blocking it broke Vercel cert auto-renew on
# www.law.ai (cert expired 2025-11-09). Removed 2026-06-13 by Luke.

Allow: /


# /search uses dynamic query parameters (name, firm, location, specialty, tier, maxDistance)
# which create distinct URLs with identical or near-identical content. Disallow to prevent
# duplicate content issues and reduce crawl budget waste. Users access search via /lawyers
# with proper canonical tags instead.

# Crawl-delay is not universally supported but helps protect dynamic routes.
Crawl-delay: 10

Sitemap: https://law.ai/sitemap.xml
# Note: llms.txt is served at https://law.ai/llms.txt for LLM crawlers (no robots.txt directive needed; the file is fetched directly).