User-agent: *
Allow: /

# Genuine private / utility paths (no public content)
Disallow: /admin/
Disallow: /admin.aspx
# NOTE: payment.aspx removed from Disallow - it has noindex meta tag.
# Google must crawl to see noindex and remove from index.
# Per Google docs: noindex requires crawling, robots.txt block prevents it.
Disallow: /message.aspx
Disallow: /login/
Disallow: /private/
Disallow: /tmp/
Disallow: /Account/
Disallow: /App_Data/
Disallow: /bin/
Disallow: /search
Disallow: /search.aspx
Disallow: /error404.aspx
Disallow: /archive
Disallow: /archive.aspx

# Cloudflare's e-mail obfuscation link and the data files the pages fetch by script:
# Google crawls them as if they were pages and reports 404 / "crawled, not indexed".
Disallow: /cdn-cgi/
Disallow: /*.json$

# Token-gated content (should never be discovered via search)
Disallow: /TourAccess.aspx

# Obsolete / internal pages (no redirect available)
Disallow: /autoMM.aspx
Disallow: /moonMM.aspx
Disallow: /moonCA.aspx
Disallow: /AutoGoldNe.aspx
Disallow: /craft-wildlifencounters.aspx
Disallow: /whre_to_eat_insydney.aspx

# Spam / externally-injected query parameters
Disallow: /*?tag=
Disallow: /*&tag=

# NOTE: Do NOT disallow parametrised URLs (?utm_source=, ?booking_id=),
# bookMe.aspx, m.* prefixes, or *.aspx/*.aspx malformed URLs.
# Those pages carry <meta robots="noindex"> and/or 301 redirects in web.config.
# Google must be able to crawl them to see those signals and deduplicate.

Sitemap: https://www.sydneytourguide.com.au/sitemap.xml
Sitemap: https://www.sydneytourguide.com.au/sitemap-images.xml