What robots.txt does, and its limits
robots.txt asks well-behaved crawlers not to explore certain paths. It is not a security measure: bad crawlers can ignore it, and a blocked page can still appear in search results if another site links to it. To keep a page out of the index, use noindex, and for sensitive data use authentication.
One file applies per host (including each subdomain and protocol). It must sit at the root of the domain, and the file name is lowercase: robots.txt.