Merge pull request 'fix(seo): keep staging out of the search index' (#111) from fix/staging-noindex into main

Reviewed-on: #111

nextjs-app/next.config.js

@@ -55,6 +55,37 @@ const nextConfig = {
   // Headers for caching and security
   async headers() {
     return [
+      {
+        /*
+         * Keep non-production hosts out of the index.
+         *
+         * Staging serves the same image as production off stx., so without
+         * this it is a full crawlable duplicate of the site.
+         *
+         * X-Robots-Tag, NOT a robots.txt Disallow. Disallow blocks crawling,
+         * which is not the same as blocking indexing — a disallowed URL can
+         * still be indexed from external links, and worse, blocking the crawl
+         * means Google never fetches the page and never sees a noindex at all.
+         * Staging therefore stays crawlable and answers "noindex" when crawled.
+         *
+         * Matched on the staging host explicitly rather than "any host that is
+         * not production". The inverted form is tempting because it would cover
+         * future environments automatically, but its failure mode is
+         * deindexing production if the Host header ever arrives rewritten by a
+         * proxy. This form's failure mode is a new environment being indexable
+         * until someone adds it here — recoverable, where the other is not.
+         *
+         * Any new non-production hostname must be added to this list.
+         */
+        source: '/:path*',
+        has: [{ type: 'host', value: 'stx.schoolcompare.co.uk' }],
+        headers: [
+          {
+            key: 'X-Robots-Tag',
+            value: 'noindex, nofollow',
+          },
+        ],
+      },
       {
         source: '/:path*',
         headers: [