# robots.txt for tasqs.com
# Public marketing pages are crawlable; the app, auth, and internal
# endpoints are not. Note: this is a request crawlers honor, not access
# control — anything sensitive must be protected server-side as well.

User-agent: *
Allow: /$
Allow: /index.php
Allow: /pricing.php
Allow: /contact.php
Allow: /privacy.php
Allow: /terms.php
Allow: /api-documentation.php
Allow: /llms.txt

# App pages (login-gated — no SEO value, shouldn't appear in search)
Disallow: /dashboard.php
Disallow: /profile.php
Disallow: /lists.php
Disallow: /tags.php
Disallow: /calendar.php
Disallow: /billing.php
Disallow: /export.php
Disallow: /print.php

# Shared list links (public but private to the recipient — keep out of search)
Disallow: /share.php
Disallow: /s/

# Auth / transactional pages
Disallow: /login.php
Disallow: /register.php
Disallow: /logout.php
Disallow: /forgot-password.php
Disallow: /reset-password.php
Disallow: /verify-email.php
Disallow: /verify-email-change.php
Disallow: /verify-2fa.php
Disallow: /pending-verification.php
Disallow: /delete-account.php

# Internal endpoints + API (defense-in-depth only — these are also
# protected server-side; robots.txt alone is not security)
Disallow: /api/
Disallow: /includes/
Disallow: /ai-config/
Disallow: /docs/
Disallow: /db/
Disallow: /gitautodeploy.php
Disallow: /mail-debug.php

Sitemap: https://tasqs.com/sitemap.xml