Hide the app from search engines

robots.txt

@@ -0,0 +1,2 @@
+User-agent: *
+Disallow: /

src/App.php

@@ -594,6 +594,7 @@ final class App
         header('Referrer-Policy: strict-origin-when-cross-origin');
         header('X-Frame-Options: DENY');
         header('X-Content-Type-Options: nosniff');
+        header('X-Robots-Tag: noindex, nofollow, noarchive, nosnippet');
         header('Cross-Origin-Opener-Policy: same-origin');
         header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
         header("Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'");

templates/layout.php

@@ -18,6 +18,7 @@ $brandSubtitle = match ($page) {
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <meta name="theme-color" content="#0b1e2e">
+    <meta name="robots" content="noindex, nofollow, noarchive, nosnippet">
     <title><?= e($pageTitle) ?> · Mood</title>
     <link rel="icon" type="image/svg+xml" href="/assets/branding/favicon.svg">
     <link rel="shortcut icon" href="/assets/branding/favicon.svg">