How do I keep my headless WordPress out of Google?

When you build a headless WordPress, the CMS still has its front end: if someone visits its domain, they see near-empty pages. We don’t want that, and we don’t want Google indexing them either.

1. Redirect the whole front end to the real one

With a must-use plugin, on the template_redirect hook (which touches neither the admin nor the REST API) you send any visit to the Astro front end:

add_action( 'template_redirect', function () {
  wp_redirect( 'https://yourdomain.com', 301 );
  exit;
} );

2. Keep it out of the index

Add the X-Robots-Tag: noindex header and serve a robots.txt that forbids crawling the CMS subdomain (Disallow: /). That way Google only ever sees your front end, never the WordPress.

The CMS becomes private: only you go in to edit. The world only sees the front end.