A noindex tag is an HTML directive, usually set with a meta tag or HTTP header, that tells search engines not to include a page in their index. Crawlers may still visit the page, but the page should not appear in search results or be used as an indexed source for discovery.
In cyber security, noindex matters because indexing controls visibility. Teams use it to hide internal portals, staging sites, login pages, duplicate content, or sensitive documents that should not be exposed through search. Attackers also look for noindex mistakes: a page blocked from search is not necessarily protected, and if the content is reachable by URL, weak access control can still expose it. For defenders, checking noindex alongside robots.txt, authentication, and crawl logs helps confirm whether a page is truly private or only omitted from search engines.