# ---------------------------------------------------------------------------
# AI / bulk-extraction crawler policy
#
# Rationale: Zabihah's asset is 25+ years of halal VERIFICATION judgements,
# not the bare fact that a restaurant exists. Crawlers that ingest the
# directory into a training corpus convert that asset into a commodity and
# send back no traffic. Crawlers that produce CITED, LINKED answers behave
# like a search engine and are welcome.
#
# So the split below is: allow the ones that link back, disallow the ones
# that train. Licensed bulk access is a product — https://www.zabihah.com/developers
#
# robots.txt is advisory. The denylist in lib/ai-crawlers.ts enforces this
# policy with a 403 for the crawlers that ignore it. Keep the two in sync.
# ---------------------------------------------------------------------------
# --- Allowed: cited-answer AI search (links back, behaves like a search engine)
User-agent: OAI-SearchBot
Allow: /
User-agent: ChatGPT-User
Allow: /
User-agent: PerplexityBot
Allow: /
User-agent: Perplexity-User
Allow: /
# --- Disallowed: model-training corpora
# Google-Extended and Applebot-Extended are robots.txt CONTROL TOKENS, not
# user agents — Google crawls with the ordinary Googlebot UA and consults this
# group only to decide whether the content may train Gemini. Opting out here
# does NOT affect Search ranking or indexing. This is the only place either
# token can be expressed; never add them to a user-agent denylist.
User-agent: Google-Extended
Disallow: /
User-agent: Applebot-Extended
Disallow: /
User-agent: GPTBot
Disallow: /
User-agent: ClaudeBot
Disallow: /
User-agent: Claude-Web
Disallow: /
User-agent: anthropic-ai
Disallow: /
User-agent: CCBot
Disallow: /
User-agent: Bytespider
Disallow: /
User-agent: meta-externalagent
Disallow: /
User-agent: meta-externalfetcher
Disallow: /
User-agent: Amazonbot
Disallow: /
User-agent: cohere-ai
Disallow: /
User-agent: cohere-training-data-crawler
Disallow: /
User-agent: Google-CloudVertexBot
Disallow: /
User-agent: AI2Bot
Disallow: /
User-agent: Timpibot
Disallow: /
User-agent: YouBot
Disallow: /
User-agent: FirecrawlAgent
Disallow: /
# --- Disallowed: commercial scraping / data-resale SaaS
# The likeliest vector for a competitor assembling a directory from ours.
User-agent: Diffbot
Disallow: /
User-agent: omgili
Disallow: /
User-agent: omgilibot
Disallow: /
User-agent: Webzio-Extended
Disallow: /
User-agent: ImagesiftBot
Disallow: /
User-agent: DataForSeoBot
Disallow: /
User-agent: SemrushBot
Disallow: /
User-agent: AhrefsBot
Disallow: /
User-agent: MJ12bot
Disallow: /
User-agent: BLEXBot
Disallow: /
User-agent: SerpstatBot
Disallow: /
User-agent: ZoominfoBot
Disallow: /
# Googlebot — throttle crawl rate to prevent server overload.
# Crawl-delay is respected by Bing/Yandex but NOT Googlebot.
# For Googlebot, set the rate in Google Search Console → Settings → Crawl rate.
User-agent: Googlebot
Allow: /
Disallow: /api/
Disallow: /admin/
Disallow: /debug/
# Shop zone (mounted at /shop) — keep admin, API, cart, and cart-state URLs
# out of the index; only the public storefront/catalog should be crawlable.
Disallow: /shop/admin
Disallow: /shop/admin/
Disallow: /shop/api/
Disallow: /shop/cart
# Note: /auth/* is intentionally NOT disallowed here. The route emits
# `` via app/auth/layout.tsx,
# and Google needs to be able to fetch the pages to see that directive.
# Blocking /auth/ in robots.txt filed 788+ URLs under "Blocked by
# robots.txt" in Search Console (grew rapidly May-June 2026) because
# Google discovered them via /restaurants/[id]/[slug]/verify links but
# couldn't crawl them to see the noindex. Letting them through +
# noindex-at-the-page means Google drops them from the crawl queue
# after processing rather than logging them as errors.
# Bing, Yandex, and others — respect Crawl-delay
User-agent: *
Allow: /
Crawl-delay: 2
Disallow: /api/
Disallow: /admin/
Disallow: /debug/
# Shop zone (mounted at /shop) — keep admin, API, cart, and cart-state URLs
# out of the index; only the public storefront/catalog should be crawlable.
Disallow: /shop/admin
Disallow: /shop/admin/
Disallow: /shop/api/
Disallow: /shop/cart
# Note: /auth/* is intentionally NOT disallowed here. The route emits
# `` via app/auth/layout.tsx,
# and Google needs to be able to fetch the pages to see that directive.
# Blocking /auth/ in robots.txt filed 788+ URLs under "Blocked by
# robots.txt" in Search Console (grew rapidly May-June 2026) because
# Google discovered them via /restaurants/[id]/[slug]/verify links but
# couldn't crawl them to see the noindex. Letting them through +
# noindex-at-the-page means Google drops them from the crawl queue
# after processing rather than logging them as errors.
Sitemap: https://www.zabihah.com/sitemap.xml
# Shop zone (zabihah-shop-v2, mounted at /shop). Served through the /shop
# rewrite; the shop app emits a at /shop/sitemap.xml listing
# its product/category/partner shards.
Sitemap: https://www.zabihah.com/shop/sitemap.xml