The trap almost every robots.txt falls into
A crawler does not merge the rules that apply to it. It finds the single group whose user-agent line most specifically matches its name, follows that group, and ignores every other group in the file — including User-agent: *.
So a file that says "User-agent: * / Disallow: /admin/" and then adds "User-agent: Googlebot / Allow: /" does not do what its author intended.
The author blocked /admin/ for everyone and added a friendly note for Googlebot. What they actually did was exempt Googlebot from the /admin/ rule entirely, because the Googlebot group is more specific and Googlebot therefore never reads the * group at all.
This is the single most common robots.txt mistake, it produces no error anywhere, and the file looks correct to anyone reading it casually. This tool checks for it directly and tells you which paths a named crawler is no longer blocked from.
What robots.txt is not
It is not a security measure. The file is public — anyone can read yours right now — and listing /admin/ in it advertises exactly where your admin panel is. Well-behaved crawlers obey it; nothing else has to.
It is also not a way to keep a page out of search results. Disallow stops crawling, not indexing: Google can still list a URL it has never crawled, based on links pointing at it, showing a result with no description. To keep a page out of results you need a noindex meta tag — which requires the page to be crawlable, so it must not be disallowed here.
That contradiction catches people constantly. Blocking a page in robots.txt to hide it from Google makes it impossible for Google to see the noindex that would actually hide it.
What to block, and what never to
Worth blocking: internal search results pages, faceted-filter URLs that generate infinite combinations, cart and checkout, admin areas, and staging subdomains. These waste crawl budget on pages with no value in search.
Never block CSS, JavaScript or images. Google renders pages before judging them, and with the stylesheet blocked it sees an unstyled page and can conclude the site is unusable on mobile. This was a real and widespread problem when WordPress security guides recommended blocking /wp-content/, and the advice still circulates.
One line deserves its own warning: Disallow: / blocks your entire site. It arrives by accident more often than you would think, copied from a staging configuration during a launch, and it can remove a site from search entirely within days.