2 files changed, 5 insertions, 2 deletions

diff --git a/docs/TESTING.md b/docs/TESTING.md
index 0275607..0e91524 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -298,7 +298,8 @@ terminal client; a saved login from one signs in the other.
 
 0. `./scripts/dev-web.sh` prints a local URL. Use it for the checks below; it
    starts a throwaway game server, gateway and static app without nginx.
-1. Open `/play/` in a fresh browser. The auth card must appear; the top bar
+1. Open `/play/` in a fresh browser. `curl -s https://zagan.2137697.xyz/robots.txt`
+   must contain `Disallow: /` for `*` and `Infrawatch`. The auth card must appear; the top bar
    must not claim a balance until login.
 2. Register, then log in with the password. The lobby must show 1 000 Kr and
    every game. Refresh the page; the session cookie must reattach and the
diff --git a/web/README.md b/web/README.md
index 3e81468..fecb710 100644
--- a/web/README.md
+++ b/web/README.md
@@ -13,6 +13,7 @@ web/
   releases.php   shared scanner and hash cache
   install.sh     stable Linux installer
   install.ps1    stable Windows installer
+  robots.txt     disallows every crawler
   play/          browser app, served at /play/
   bin/gui/       apps, served at /bin/gui/...
   bin/client/    terminal clients
@@ -151,7 +152,8 @@ Then open <http://127.0.0.1:8899/>.
 ```
 
 `deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
-half-written binary, then fetches the live page and every artifact it lists —
+half-written binary, then checks `robots.txt`, fetches the live page and every
+artifact it lists —
 GUI apps, installers, terminal clients and servers — and compares the
 downloaded bytes with the local SHA-256. It also fetches `/play/`, `app.js` and
 `style.css`. `--verify-only` skips the upload and only checks the live site.