Last week I did a relaunch on a website and today I have realized that the staging subdomain got indexed by Google. I want to avoid this mistake in the future and track down the error source.

I assume that it has to do with the .htaccess file and cached redirects.

The .htaccess file is structured like that

# A bunch of 301 redirects
Redirect 301 /url https://stage.example.com/url 
Redirect 301 /url1 https://stage.example.com/url1 
Redirect 301 /url2 https://stage.example.com/url2

# Now the password protection
AuthType Basic
AuthName "Password Protected Area"
AuthUserFile /customer/homepages/30/544361357/htdocs/example/.htpasswd
Require valid-user

Could it be that the redirects are processed before the password protection?

  • Where is this .htaccess file? (Those redirects imply that this is not the .htaccess file that is "protecting" your stage.example.com subdomain?) – MrWhite Jul 27 '18 at 20:38

The fact that your staging site was indexed has at least as much, if not more so, to do with the lack of access controls on https://stage.example.com ...

It could be that a Redirect directive on your main site was responsible for disclosing the URL, but as far as I know access controls are applied by Apache before the Redirect is allowed, regardless of the order in which those two different classes of directives are listed in your .htaccess file.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.