Short answerKeep agent pages behind a sign-in, and when a page must be public, serve it with a noindex rule that crawlers can fetch. Don’t rely on robots.txt or an unguessable URL alone. Overto pages are private by default, and its public links carry noindex.
Why agent pages leak
A dashboard built from last week’s incidents or a prototype with real customer names is easy to make and easy to post. Many quick hosts publish to a public link by default: Netlify Drop gives every dropped project a public link by default, and Tiiny Host says all uploaded content is publicly available at your link unless you add a password on a paid plan. A public link that is posted anywhere a crawler can follow can end up in search.
1. Keep pages behind a sign-in
A crawler can’t sign in to your workspace, so the safest default is a page that opens only for people you choose. In Overto, every page starts behind workspace sign-in. Projects decide who can read it: everyone in the workspace, the people and teams you grant, or only you.
2. If it must be public, send noindex
Google honours a noindex rule given as a <meta name="robots" content="noindex"> tag in the page head or as an X-Robots-Tag: noindex HTTP header. The header also works for PDFs, images and other files. Overto’s public links send X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, noimageindex on every response, including the page’s assets.
3. Don’t rely on robots.txt alone
Blocking a page in robots.txt stops crawlers from fetching it, which also stops them from seeing its noindex rule. Google notes such a page can still appear in results if other pages link to it. Use noindex or a sign-in instead.
4. Share the least you need
- Only the current page. An Overto public link serves the current published page and its files. Comments, editable source, drafts and older versions stay private.
- Only documents and websites. Other files and audio can’t be made public on Overto.
- Only the people allowed. Turning on a public link needs permission to manage and publish to the project, and agents never get more access than the person who connected them.
5. Turn it off when you’re done
Turn the public link off when the outside review is over. New requests stop at once; copies someone already downloaded can’t be recalled, so keep secrets out of pages you make public in the first place.
Frequently asked questions
Will Google index a page my agent published to Overto?
Not through Overto. Private pages open only after sign-in, and public links are served with an X-Robots-Tag header that tells search engines not to index, follow, archive or snippet them.
Is robots.txt enough to keep a page out of Google?
No. Google says a page must not be blocked by robots.txt for a noindex rule to work, because a crawler that can’t fetch the page never sees the rule. A blocked page can still appear in results if other pages link to it.
What should I do if a page is already indexed?
Make it private, or add a noindex rule that crawlers can fetch, and ask the search engine to recrawl it. Remember that copies someone already downloaded can’t be recalled.
Does turning off a public link delete copies?
Turning off public access stops new requests to the page. It can’t recall copies someone already downloaded. Access & sign-in.
Can my agent make a page public on its own?
Only with your access. Agents never get more access than the person who connected them, and making a page public needs permission to manage and publish to the project.
Sources
Third-party facts on this page come from each vendor’s own pages, last checked on . Products change often; check the source before relying on a detail.
Last checked . Netlify and Netlify Drop are trademarks of Netlify, Inc. The names are used only to identify those products. Overto is an independent product and is not affiliated with or endorsed by Netlify. Tiiny Host is a trademark of Tiiny Labs Ltd. The name is used only to identify that product. Overto is an independent product and is not affiliated with or endorsed by Tiiny Labs.