Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've heard that you shouldn't let search engines index your development server. The reasons given were:

  • Duplicate content penalties
  • Customers making purchases from an unsecured domain (if eCommerce)

These issues may seem relatively minor and I'm not sure it would be enough to convince someone to put in the effort to lock down the server. Aren't there broader security concerns? What should be secured and why?

share|improve this question
You might consider it a problem if a search engine can even find your dev server. – Anthony Pegram Sep 21 '11 at 19:10
What's a development server and why is it in public domain ? – Pankaj Upadhyay Sep 21 '11 at 19:24
Why is this question downvoted and closed? It's actually constructive and interesting, especially with a perfectly valid and valuable answer by JB King. There are also plenty of cases where making the development server accessible publicly from internet makes sense, and only indexing by a search engine can hurt. – MainMa Sep 21 '11 at 19:33
@MainMa Let's make a list of every bad thing that can happen due to every common mistake, so people can look at all of the potential bad things and decide if the risk of doing something silly can be managed? If you don't want the world to see your painting until it's done, don't let search engines take a picture of the work in progress. At some point, common sense has to triumph, at least I hope it does. – Tim Post Sep 21 '11 at 19:44
I've proposed an edit that hopefully addresses the issues here. – Matthew Read Sep 21 '11 at 19:52
up vote 8 down vote accepted

The most glaring and obvious problem with this is the fact that your development server is even publicly accessible.

Search engine penalties and other related issues aside, there are a plethora of problems with having your dev server unsecured.

While there's nothing wrong with having your dev server on the Internet, it should at the very least be password-protected so as to prevent unauthorized access of what may be insecure and and otherwise immature code.

Password-protecting Apache can be accomplished through use of .htpasswd. For IIS you modify the Authentication and Access Control settings.

share|improve this answer
Can you please give some examples of why it is bad to have a development server on the Internet? What if different people that need to work on or approve things are in remote locations? – JD Isaacks Sep 21 '11 at 19:17
@John Isaacks It's one thing to have a dev server on the Internet. It's another to have it publically available on the Internet. – Thomas Owens Sep 21 '11 at 19:18
@Paperjam, thanks for the info, I was not aware of those issues. – JD Isaacks Sep 21 '11 at 20:14

What about having information enter the public domain that may not be intended? Some companies may want to protect who can see upcoming products and services which could be an issue if the development site can be found on Google. The other thought is that the dummy content on the page may harm a company's brand as "Lorem ipsem" content isn't usually considered professional. TheDailyWTF will have posts of such content that I'm not sure if companies would want their name associated with such stuff. Security issues can also be a bit of a problem as development environments may not always be as locked down as production so passwords may be easier to crack.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.