Hide from search, noindex, and private

Two mechanical things, both aimed at search engines specifically: a robots directive (noindex, nofollow) on the page, and dropping the URL from sitemap.xml so you're not handing Google a map to a page you don't want indexed.

That's the whole feature. It's a search-engine opt-out on a URL that's still public. It is not a privacy switch, and it is not a site-wide lock.

Open Graph and Twitter Card tags are still emitted on that URL, because those aren't a search-indexing signal. They're what any link-unfurling client (Slack, iMessage, LinkedIn, Discord) reads to build a preview card. A chat app doesn't check robots meta before it renders a card; it just fetches the URL and reads the OG tags. Noindex tells Google "don't list this." It says nothing to Slack.

Same logic applies to self-hosted WordPress or Discourse: they can still pull a live oEmbed for a hidden public photo or gallery URL, because oEmbed also isn't a search-indexing mechanism. The page is still public. Hiding it from search never made it private. It just stopped it from showing up in a Google result.

JSON-LD is the exception on the search side: hidden pages, posts, and galleries omit their structured-data blocks. The chat card still renders. That's consistent with the job split: schema is for crawlers; OG is for unfurlers.

"Hidden" is a discovery setting. "Private" is an access setting. Confusing them is the actual risk here, not the OG card. If a gallery genuinely shouldn't be seen by anyone without permission, hiding it from search doesn't accomplish that; moving it into private portfolio storage does. Hide-from-search is for content you're fine with anyone-with-the-link seeing, you just don't want it competing for search real estate: a proof gallery mid-edit, a draft page, a portfolio piece you're retiring from public search but still want to link from an email.

For the fuller breakdown of public vs. private portfolio structure itself (the storage and access model, not the search-visibility layer), see Public vs private work. This page is the companion covering what search-visibility settings do and don't do to a URL that's already public.

Want it linkable, just not Google-findable? Hide from search. Want it actually inaccessible without permission? Private portfolio, not a hide toggle. Sending a link and don't want a preview card at all, regardless of hide status? That's a client-side chat setting on their end, not something a noindex tag controls from yours.