§
01
Two files
Two default files, side by side
On 16 September 2026 we fetched /robots.txt from 38 Shopify storefronts. The 23 without a custom template, Shopify's own Dawn demo store among them, served a new managed file that opens with a comment block for AI agents and has two groups, * and adsbot-google. The stores with a robots.txt.liquid printed the older default set that Shopify's robots.default_groups loop still returns, with extra groups for Nutch, AhrefsBot, AhrefsSiteAudit, MJ12bot and Pinterest. Most of the blocks overlap. Two don't.
| Pattern | Managed file (no template) | Loop output (with a template) |
|---|
/admin | Blocked | Blocked |
| Cart | Blocked (/cart/, /cart.js) | Blocked (/cart, /carts) |
/checkout, /checkouts/, /orders | Blocked | Blocked |
/account | Blocked, /account/login allowed | Blocked |
Sorted collections (*sort_by*) | Blocked | Blocked |
Tag combinations (/collections/*+*) and two or more filters | Blocked | Blocked |
| Theme preview links | Blocked | Blocked |
/search | Crawlable (search results send a noindex header) | Blocked |
/policies/ | Crawlable | Blocked |
| Groups for Nutch, AhrefsBot, AhrefsSiteAudit, MJ12bot, Pinterest | None | Present |
| Sitemap line | Yes | Yes |
The help page's list1 matches the second column, not the first. Shopify hasn't announced the change that we could find. Your store's file is at your-store.com/robots.txt; if the first line reads "# Shopify storefront.", you're on the managed file. The research note on the managed default has both files side by side, the rule-by-rule diff and the 38 storefronts we checked.
§
02
Private pages
/admin, /cart, /checkout — the private pages
Both files block the pages that only make sense for one signed-in person. /admin is the Shopify merchant admin; no public crawler should ever index it. The cart is empty for any crawler and different for every shopper. /checkout and /checkouts/ are the payment flow, and /orders and /account hold customer data. The managed file adds one refinement: it blocks /account but allows /account/login, so the login page itself can still be crawled. None of these pages would be worth anything in search.
Worth knowing: the /admin block does not prevent unauthorized access to the admin (the admin has its own authentication). It only prevents crawlers from requesting admin URLs. The same applies to /checkout — the block is a crawl-prevention layer, not a security layer.
§
03
Filter duplicates
/collections/*+* and other filter combinations
The /collections/*+* pattern is a robots.txt wildcard matching any collection URL with a + character in it, the signature of combined tag filters such as /collections/dresses/red+xl. Both files also block the encoded forms (%2B and %2b), sorted collection URLs (sort_by), URLs that combine two or more filter parameters, and the same patterns under blogs and Markets subfolders. The blocks exist to stop combinatorial duplicates: a collection with ten filters can produce thousands of URL combinations, most with overlapping products and no search demand.
Google's faceted-navigation guidance lists this as a legitimate choice: if you don't need faceted URLs in Google Search, "Use robots.txt to disallow crawling of faceted navigation URLs"3. A single filter, such as ?filter.v.availability=1, is not blocked by either default. For more on this pattern, see /shopify-seo/filtered-collections/.
§
04
Dropped blocks
/search and /policies/ — the blocks Shopify dropped
The managed file no longer blocks /search or /policies/, and its first line spells out that 'Public product, collection, page, blog, policy, cart, and localized HTML is crawlable.' Internal search result pages (/search?q=...) now send an X-Robots-Tag: noindex, nofollow header instead, on stores with and without a template. That's the better tool for keeping them out of Google: a noindex only works if Google may crawl the page, and a robots.txt block hides it.
Google's own documentation says it plainly: "For the noindex rule to be effective, the page or resource must not be blocked by a robots.txt file," and a blocked page can still appear in results if other pages link to it5. The counterpoint is crawl budget. Google's guide for very large sites (a million-plus pages, or 10,000-plus changing daily) prefers robots.txt for pages it should never crawl, because a noindexed page is still fetched6. Most Shopify stores are nowhere near that size.
Policy pages at /policies/refund-policy and the like are now crawlable on the managed file too. Stores with a template still block them through the loop, which is worth fixing if you want policy content to reach search engines and AI answer engines. See internal search and noindex for the search side.
§
05
Leave alone
Which defaults to leave alone
Leave the private-page blocks (admin, cart, checkout, orders, account) and the filter and sort blocks exactly as Shopify ships them: unblocking them opens thousands of useless or private URLs to crawlers and gains nothing. /search and /policies/ are different, because Shopify itself stopped blocking them in the managed file. If your store has a robots.txt.liquid and you want to match that, skip those rules with Shopify's documented unless pattern rather than rewriting the file as plain text. Shopify's verbatim warning still applies to every edit: 'Incorrect use of the feature can result in loss of all traffic.'
The right pattern for anything you want to rank is still a real page, not an unblocked default. Want a high-intent search query to rank? Build a named collection page at /collections/red-wedding-dresses. Want a specific filter combination indexed? Same answer — build a named collection.
For the rules layered on top of these defaults — AI-bot blocking, app-route disallows, additional sitemaps — see the robots.txt.liquid hub and the AI-bot leaf at /shopify-seo/robots-txt-ai-bots/.
