A subdomain containing “staging” is not automatically private. If it opens without authentication, people and crawlers can request its content. A separate hostname is not access control.
Assess access from outside the team session
Fictional example: a team uses staging.example.com for new service pages. Their work browsers retain a login, so nobody notices that individual pages also open without a session.
Check a deep page, the homepage and a known media file while signed out. Confidential material needs appropriate access protection. A “preview” banner does not change who can retrieve it.
For publicly accessible test content that should stay out of search results, noindex can provide an indexing instruction. That is a different objective. Crawlers need to retrieve the instruction, so a simultaneous robots.txt block can prevent it from being read.
Check connections to the main website
Look for staging links on the public site. Include sitemaps, canonical URLs and generated media addresses. An incorrect base-host setting can carry preview addresses into production.
Record who maintains access protection and which settings must survive the next deployment. Check them again after infrastructure changes. If confidential content was already public, merely removing a sitemap afterwards does not fix the underlying access problem.
Include the sitemap in the check
A login protecting article pages does not automatically protect /sitemap.xml or its child files. A public URL list can reveal names of unpublished offers. Disable the preview sitemap or place it behind the same access controls. Remove draft URLs from the main website’s sitemap as well.
The generator must explicitly distinguish production from preview. An incidental hostname or a browser switch is insufficient. Check the file again without a session after the change.
Recheck after a domain change
Authentication at the old proxy cannot protect a new hostname that points directly to the application. Before moving, record which layer enforces access. Afterwards, check each intended preview hostname and any known direct infrastructure addresses within your own operation.
Include media and downloads. Compare public base URLs, canonicals and sitemaps between preview and production. Record hostname, time and observed response without recording credentials. If an alias bypasses protection, correct that access first.
Related check: Distinguish robots.txt from noindex.
For preview and production separation, the Technology and stack review provides a defined deployment assessment, not a security certification.