4

I've heard that you shouldn't let search engines index your development server. The reasons given were:

  • Duplicate content penalties
  • Customers making purchases from an unsecured domain (if eCommerce)

These issues may seem relatively minor and I'm not sure it would be enough to convince someone to put in the effort to lock down the server. Aren't there broader security concerns? What should be secured and why?

Improve this question
9
  • 22
    You might consider it a problem if a search engine can even find your dev server.
    – Anthony Pegram
    Sep 21, 2011 at 19:10
  • 1
    What's a development server and why is it in public domain ?
    – Pankaj Upadhyay
    Sep 21, 2011 at 19:24
  • 2
    Why is this question downvoted and closed? It's actually constructive and interesting, especially with a perfectly valid and valuable answer by JB King. There are also plenty of cases where making the development server accessible publicly from internet makes sense, and only indexing by a search engine can hurt.
    – Arseni Mourzenko
    Sep 21, 2011 at 19:33
  • 3
    @MainMa Let's make a list of every bad thing that can happen due to every common mistake, so people can look at all of the potential bad things and decide if the risk of doing something silly can be managed? If you don't want the world to see your painting until it's done, don't let search engines take a picture of the work in progress. At some point, common sense has to triumph, at least I hope it does.
    – Tim Post
    Sep 21, 2011 at 19:44
  • 3
    I've proposed an edit that hopefully addresses the issues here.
    – Matthew Read
    Sep 21, 2011 at 19:52

2 Answers 2

Reset to default
8

The most glaring and obvious problem with this is the fact that your development server is even publicly accessible.

Search engine penalties and other related issues aside, there are a plethora of problems with having your dev server unsecured.

While there's nothing wrong with having your dev server on the Internet, it should at the very least be password-protected so as to prevent unauthorized access of what may be insecure and and otherwise immature code.

Password-protecting Apache can be accomplished through use of .htpasswd. For IIS you modify the Authentication and Access Control settings.

Improve this answer
3
  • Can you please give some examples of why it is bad to have a development server on the Internet? What if different people that need to work on or approve things are in remote locations?
    – JD Isaacks
    Sep 21, 2011 at 19:17
  • 3
    @John Isaacks It's one thing to have a dev server on the Internet. It's another to have it publically available on the Internet.
    – Thomas Owens ♦
    Sep 21, 2011 at 19:18
  • @Paperjam, thanks for the info, I was not aware of those issues.
    – JD Isaacks
    Sep 21, 2011 at 20:14
6

What about having information enter the public domain that may not be intended? Some companies may want to protect who can see upcoming products and services which could be an issue if the development site can be found on Google. The other thought is that the dummy content on the page may harm a company's brand as "Lorem ipsem" content isn't usually considered professional. TheDailyWTF will have posts of such content that I'm not sure if companies would want their name associated with such stuff. Security issues can also be a bit of a problem as development environments may not always be as locked down as production so passwords may be easier to crack.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.