robots.txt, sitemap.xml, Canonical Tags & Noindex
These four checks tell search engines how to crawl and index your site. Every scan Nivaronix runs includes them, but they are visibility signals about how discoverable your site is — not security findings.
Last updated August 12, 2026.
Does this affect your Nivaronix security score?
This is an SEO/visibility signal, not a security finding. Nivaronix reports it at Info severity, and Info-severity findings carry a 0-point deduction — this result does not change your Nivaronix security score.
The four checks, at a glance
robots.txt
What it is: A plain-text file at /robots.txt that tells search-engine crawlers which parts of your site they may or may not request, and can point them at your sitemap.
What Nivaronix checks: Nivaronix requests /robots.txt and checks for an HTTP 200 response whose body actually looks like a robots.txt file (not empty, not an HTML error page routed to 200). If found, it counts the recognised directive lines (user-agent, disallow, allow, sitemap, crawl-delay) present.
sitemap.xml
What it is: An XML file, typically at /sitemap.xml, listing the URLs on your site you want search engines to discover and index.
What Nivaronix checks: Nivaronix requests /sitemap.xml and checks for an HTTP 200 response whose body contains a recognisable <urlset> or <sitemapindex> element.
Canonical tag
What it is: A <link rel="canonical"> tag in a page's <head>that declares which URL is the authoritative version of that content, so search engines don't split ranking signals across near-duplicate URLs (with/without trailing slash, tracking parameters, http vs https, and so on).
What Nivaronix checks: Nivaronix fetches the scanned page and looks for a canonical link tag. It flags a missing tag, a tag with an empty href, and the case of multiple canonical tags pointing at different URLs — receivers of that last state are as likely to ignore all of them as to pick one arbitrarily.
Noindex signal
What it is: An instruction to search engines not to index a specific page, set via either an X-Robots-Tag: noindex HTTP header or a <meta name="robots" content="noindex"> tag.
What Nivaronix checks: Nivaronix checks the response headers for an X-Robots-Tag containing noindex and scans the page body for a matching meta robots/googlebot tag. Either source triggering counts as noindex present.
Why these are informational, not security findings
A missing sitemap or a missing canonical tag doesn't expose data, weaken encryption, or open an attack surface — it changes how efficiently search engines discover and rank your content. That's a real business concern, which is why Nivaronix surfaces it on every scan, but it's a different kind of concern than a missing security header or an expired certificate. Every finding in this cluster is reported at Info severity for exactly that reason — see the score note above for how that maps to your Nivaronix score.