Home/Guides/Bot Defense
Bot Defense

Shielding Ephemeral Media from Search Indexers, Crawlers, and AI Scrapers

How robots.txt, HTTP headers, authentication gates, and noindex meta tags prevent search engines and generative AI scrapers from harvesting temporary files.

By Locky Infrastructure Team•6 min read•Updated 2026-10-19•Bot Defense

The Aggressive Web Scraping Landscape

In the era of large language models (LLMs) and automated image generators, web scrapers aggressively crawl billions of public URLs daily. If temporary files are exposed to crawlers, private images can be sucked into machine learning training sets.

Preventing automated discovery requires strict defense-in-depth across multiple network layers.

Key Architectural Takeaways

  • Robots.txt disallows all major search crawlers (Google, Bing, Apple) from /v/* and /api/*.
  • Dynamic noindex, nofollow robots headers prevent search engine indexing.
  • PIN authentication gates prevent scrapers from accessing raw binary media streams.

Robots.txt and Header Policies

Locky's robots.txt explicitly disallows /api/* and /v/* for all user agents (* and Mediapartners-Google). Furthermore, the viewer page dynamically emits: robots: { index: false, follow: false, noarchive: true }.

Search engines that respect web standards never index ephemeral media URLs.

Advertisement

The PIN Gate as a Hard Barrier

Even if a rogue bot ignores robots.txt, the raw media file is never served on initial page load. The bot encounters a client-side PIN entry form. Without solving the Cloudflare Turnstile token and submitting the correct 4-digit PIN, the cloud storage presigned URL is never generated.

Try Zero-Knowledge Ephemeral Sharing

Need to share a photo or video privately without permanent digital footprint? Locky strips location metadata client-side in your browser, locks media behind a 4-digit numeric PIN, and guarantees automatic self-destruction in 24 hours.