Noindexing Your Incident Page Is a Self-Pwn

One simple tag tells me almost everything about how a company thinks about incident disclosure: “noindex.”

Put it on your incident page and you’ve asked search engines to act as if your page doesn't exist. The incident still exists; as do the headlines. The only thing you removed from search is your own account of what happened.

Tell me you don't understand the internet with a single command.

The story still ranks without you.

Search engines don't forget an incident simply because they’re skipping your page. Reporters still cover it and customers post about it on Reddit and social media. Researchers write threads, and breach trackers catalog it. All of that gets indexed, and all of it now ranks where your page should be.

And an incident page is more than a statement now. People expect resources, technical postmortems, and mitigation advice. That page is where you demonstrate credibility in how you handle incidents and maturity in how you talk about them. Noindexing hides the best evidence you have that you can be trusted.

The people searching are the ones you most need to reach with your story and when they can't find you, they read someone else's interpretation instead. Brilliant.

Your tag is public.

Additionally, a noindex directive sits in the page source or the response headers, and the audience most likely to read your incident page is the audience most likely to check. Security researchers and journalists view source out of habit. Once someone spots it, the story shifts from what happened to what you tried to bury. You have handed critics a screenshot-ready example of bad faith, and it undercuts every word about transparency.

What to do instead

Treat the incident page as the authoritative source it’s supposed to be.

• Index it. Title and describe it so it ranks for the searches people actually run, such as "[$company] security incident."
• Give it a permanent home. Link it from your trust or security center and keep the URL stable so every update lives in one place.
• Keep it current. Add the technical postmortem and mitigation guidance as they're ready, with a dated update log so reporters have something to cite and customers know they’re reading the latest available guidance.
• Let it age. Interest fades, and the page's ranking fades with it. If your brand results worry you, publish better content. Hiding the evidence is not a search strategy (plus, it’s not really hidden anyway, you just look shady).

The whole point of publishing an incident page is to put your account, your analysis, and your guidance where people will look for it. A noindex tag defeats that purpose and leaves you with every downside of having published anyway. If you are going to disclose, disclose where the internet can see it. Otherwise you may have met a bare minimum requirements for the court record, but people will judge you for tryingto hide it. So will the court, by the way.