We have a number of test environments that are permanently internet facing to accommodate external and automated testers with dynamic IP addresses. While we regularly check the servers for security vulnerabilities etc, we found that the servers were indexed by Google and other search engines. This led to a situation where customers were clicking on search engine links and attempting to make use of the UAT environment for business. We've put a few controls in place now to ensure this does not happen again but to avoid future errors, I was hoping there is a full standard available to say e.g.
- Ensure sites are not searchable by search engines by making use of Robots.txt or other meta tags
- Clearly mark UAT environments as different from Prod environments
Is there a standard / checklist available for this specific use case?