WordPress glossary
robots.txt Hijack
A compromise that rewrites robots.txt to block legitimate crawlers or allow attacker paths Google should never see.
Last updated ยท Reviewed by Ali Yasin Jatoi
A hijacked robots.txt typically adds Disallow rules that cut off Google from your real content, or adds Allow rules exposing /wp-admin/, /staging/, or attacker drop folders. Always serve robots.txt from a real file or a controlled route, never from a plugin setting an attacker can edit through the database. Diff against your known-good copy after any suspected compromise.