A PDF has no HTML head in which to place a robots meta element. An indexing instruction for a publicly reachable document can instead be delivered in its HTTP response. Inspect the file’s response, not merely the HTML page linking to it.
This does not protect a confidential price list. Anyone who knows a public file’s address may still download it; restricted material needs access control.
Inspect the delivery response
Replace the placeholder with your own public test document:
curl -sS -D - -o /dev/null https://example.invalid/download/prices.pdf
Alongside the actual status, the response might contain:
Content-Type: application/pdf
X-Robots-Tag: noindex
The command downloads and discards the response body. Use a small test file. If the address redirects, inspect the final file host’s response. A header on an intermediate redirect is not sufficient evidence.
Check the actual delivery path
A CDN or object store may apply different headers from your web server. Test the real proxy or signed-download route when one is involved. Avoid a broad header rule that accidentally marks every product page as noindex.
Record the test address, time, response status and header. Repeat the check after replacing the file: uploads can change stored response metadata. The header proves what your server currently delivers, not whether Google has processed it. Check existing search appearances separately in Search Console.