You sent a client a link to a quote, and now you wonder who else could find that page. Maybe a price sheet sits on your site with no menu link, or a proposal lives in a shared folder. You want to keep a page out of Google search, and you want to know whether any of yours already show up.
"Private" can mean two different things. One is staying out of Google's results. The other is stopping people without permission from opening the page. A noindex rule handles the first. A password or login handles the second.
Google updated its Search Central guidance on October 26, 2026, and it sets a default for pages made to be shared by link. You can check your own pages in about ten minutes, and a single exposed page is often one setting away from fixed.
Key Takeaways
Noindex keeps a page out of Google Search while anyone with the link can still open it. A password or login is the control for confidential material.
Pages made for direct sharing, collaboration or utility should carry a noindex rule or a robots.txt crawl block by default, per guidance updated October 26, 2026.
It controls crawling, a blocked URL can still appear in results, and the block can stop Google from ever seeing a noindex rule.
The Search Console Removals tool hides a URL for about six months, so finish the noindex, login or deletion before it expires.
How do you keep a page out of Google search?
Match the control to what the page is for. If people may still open the page by its link, add a noindex rule. If the content is confidential, put it behind a password, login, member account or client portal. If the page or file is obsolete, delete it and let the address return a 404 or 410 status.
Google's Prevent User-Generated Spam guidance, last updated October 26, 2026, adds a section titled "Only index content meant for Search." Its key sentence reads: "When pages are created for direct sharing, collaboration, or utility rather than public search discovery, apply the noindex rule (using a robots meta tag or X-Robots-Tag HTTP response header) or block crawling in robots.txt by default."
That page is Google's anti-spam guidance for sites and services that let users create shareable pages, generated outputs or interactive tools. For a small business, it applies to the quote pages, proposal pages, client portals, booking confirmations and tools on your own site. Files you share through Google Drive follow Drive's own help instead.
Google's documentation on blocking indexing adds one condition for noindex: Google has to be able to crawl the page to see the rule. A noindex rule works on a page in a robots meta tag or in an X-Robots-Tag header, and the header version also covers PDFs and other files that have no page code.
Which control fits a quote, a portal or a shared file?
Every page you share by link falls into one of a few cases, and each case has one right method. The table maps the common ones. Read across the row that matches your page, then apply the control in the second column.
| Page or file | Control | What it does |
|---|---|---|
| Quote or proposal page that people open by link | Noindex rule | Keeps it out of Google Search; the link still opens it |
| Price sheet or client file with confidential details | Password or login | Stops anyone without access, including Googlebot |
| Client portal | Login required | Authentication blocks Googlebot from the content |
| Booking confirmation or utility page | Noindex rule | Keeps it out of Google Search |
| Old quote, price list or file nobody needs | Delete it | Returns a 404 or 410 status |
| File on Google Drive | General access set to Restricted | Only approved people can open it |
Google says password protection is the method for confidential content, and that authentication keeps Googlebot from reaching the page at all. That makes a login stronger than noindex for privacy. A noindex rule is a request to Google Search; it does nothing to the visitor who holds the link.
Obsolete files are the easiest fix. If an old price sheet or proposal no longer needs to exist, delete it. Google's removal guidance treats deletion with a 404 or 410 status as a permanent answer.
What does robots.txt actually do for a shared page?
Robots.txt controls crawling, which is Google's visits to read a page. It is not a reliable way to keep a URL out of the index. A blocked URL can still appear in results if Google learns about it from somewhere else, such as a link on another site.
There is a second problem. If you block a page in robots.txt, Google cannot fetch it, so it never reads a noindex rule on that page. The two controls can cancel each other out, which is why a page that needs to stay out of search should carry the noindex rule and stay crawlable.
Google's guidance for platforms lists a robots.txt block as an option for shared pages. For your own quote and proposal pages, the cleaner choice is noindex, or a login when the content is confidential. If you want the background on how the file works, our post on whether your website needs a sitemap and robots.txt covers it.
How do you check whether Google already lists your shared pages?
Start in Google itself. Type site: followed by your domain, then a distinctive word from a private quote, a price sheet or a client name. Repeat with filetype:pdf added, because files uploaded to a site can be listed separately from its pages. Google documents both in its search operators help.
Write down every result that shows material meant only for a customer or for your team. Then open each one in a private browser window. If the page opens without a login, anyone can read it, whether or not Google lists it.
Ten-minute check
Use site:yourdomain.com plus a word from a quote, price sheet or client name.
Add filetype:pdf and search distinctive phrases in quotation marks.
Use a private browser window to see whether the page loads without a login.
Paste it into URL Inspection in Search Console to see whether Google reports it as indexed.
Note whether it is a page, a PDF, a platform-hosted file, a staging page or a portal.
URL Inspection in Search Console shows whether Google has indexed a specific address and what Googlebot can reach there. If a page is listed and Search Console shows it as indexed, move to the removal steps. Our post on page not indexed in Search Console explains the status labels you may meet.
How do you remove a page that already shows in Google?
Use two steps in this order: a quick temporary block, then the permanent fix. If you own the site in Search Console, the Removals tool hides a URL fast. Google's Removals tool help says an approved request lasts about six months.
Six months is the limit, so the fix cannot end there. Before the block expires, add noindex, put the page behind a login, or delete it and return a 404 or 410 status. Enter the exact address shown in the Google result, including capitalization and any parameters, so the request matches the listed URL.
If you do not own the site, the options are narrower. Google's Refresh Outdated Content tool applies only when the page has been deleted or materially changed. It updates Google's listing; it does not take down the live page, so ask the site's owner to fix the page itself.
What do Squarespace, Wix, WordPress and Google Drive say about hidden pages?
Each platform has its own wording, and a page that is hidden from the menu is not the same as a page that is protected. These settings come from each platform's own help pages, and screens change, so confirm the option in your own account.
Squarespace says a page set to Not Linked stays reachable by visitors and search engines. A password, member access or noindex setting blocks search access, per its page access help. Wix says hiding a page from the site menu does not prevent indexing, and its help on pages that appear in Google points to noindex or password protection.
WordPress pages are public by default. WordPress documents page visibility settings of public, private, password protected and draft, and it has a separate guide to password protecting posts. Our post on WordPress image attachment pages covers one place where files turn into public pages without anyone planning it.
For Google Drive, "Anyone with the link" lets anyone who holds the URL open the file without signing in. Google says such files are not automatically indexed, though a direct link posted on a public, crawlable page can make a file easy to find. In Drive's sharing help, change General access from Anyone with the link to Restricted when only named people should open it.
A client portal needs a real login. A long, hard-to-guess address is not a lock, so confirm that your portal asks every visitor to sign in before it shows a document.
When is one setting enough, and when is outside help worth it?
One exposed page is usually a small job. A platform setting, a Drive permission change, a password or a deletion can fix it in a few minutes. A broad SEO campaign is not the answer to a single URL, and nothing can promise that the internet forgets a page instantly.
Outside help earns its place when the problem is bigger than one address. That includes many URLs, media files you cannot list, staging copies of your site, documents spread across several platforms, client portals, pages that users create on their own, or doubt about whether a fix worked.
In that situation the work is an inventory and a check: list every address, decide who should reach each one, set the right control, remove what is already listed, and confirm the result in Search Console. If portals, templates or access rules need changes, that is build work on the site itself.
Which control does the page need?
Pick an answer to begin.
1. A proposal page should stay open to anyone with the link but out of Google Search. What fits?
2. A page holds confidential pricing for one client. What is the right control?
3. You request a Search Console removal for an exposed page. What comes next?
Frequently Asked Questions About How to Keep a Page Out of Google Search
Can an unlisted page appear in Google?
Yes. A page left out of your menu can still be crawled and indexed. Squarespace says a Not Linked page remains reachable by search engines, and Wix says hiding a page from the menu does not prevent indexing.
Does noindex stop people with the link from opening the page?
No. Noindex keeps the page out of Google Search. Anyone who holds the link can still open it, so use a password or login for confidential content.
Does robots.txt remove a page from Google?
No. Robots.txt controls crawling. A blocked URL can still appear if Google learns about it elsewhere, and the block can stop Google from reading a noindex rule on the page.
How do I hide a PDF from Google?
Put the file behind a login, delete it, or serve it with an X-Robots-Tag noindex header if people still need to open it by link. Confidential files need a login.
How long does the Search Console Removals tool last?
About six months. Google describes it as a temporary block, so add noindex, require a login or delete the page before it ends.
Can a Google Drive file shared with "Anyone with the link" show up in search?
Google says such files are not automatically indexed, but a direct link posted on a public, crawlable page can make the file easy to find. Change General access to Restricted when only certain people should open it.
Final Thoughts
Keeping a page out of Google search comes down to choosing the right control for each page. Noindex fits pages people open by link. A password or login fits anything confidential. Deletion fits files nobody needs. Robots.txt and a hidden menu link do not do the job, and a Search Console removal only buys time.
The check takes minutes: search your domain for a word from a quote or price sheet, open what you find in a private window, and inspect the URL in Search Console. A short list of what you share by link, and who should open each item, keeps the problem from returning the next time you send a proposal.
If you have many shared pages, files on several platforms, a client portal or staging copies you cannot account for, Web Leveling can list every address, set the right control on each and confirm the result. That work sits within our search engine optimization service, and we will tell you plainly if one setting is all you need. We work with small and medium businesses across the country and overseas. Contact us about your shared pages and we will look at them with you.
Terms
Words used in this post
Tap a term to see what it means.
Noindex. A rule, set in a robots meta tag or an X-Robots-Tag header, that tells Google not to show a page in Search.
Robots.txt. A file on your site that tells crawlers which addresses they may visit; it controls crawling, not indexing.
X-Robots-Tag. An HTTP response header that carries indexing rules, and works for files such as PDFs.
Googlebot. Google's crawler, the program that visits pages so Google can read them.
Removals tool. A Search Console tool that hides a URL from Google results for about six months.
Authentication. A login or password check that stops visitors without access, including Googlebot, from opening a page.
