I found several URLs from our staging subdomain in Google results, even though the site is meant to be private. The pages aren’t linked from our main website, but they can still be opened if someone has the URL.
Could this happen because the staging site is publicly accessible, or is there another way Google might have discovered it? I’m also unsure whether blocking the subdomain in robots.txt would remove pages that are already indexed, or just stop Google from crawling them. What’s the right way to handle staging subdomain indexing without accidentally hiding pages on the live site?