diff --git a/deploy/caddy/Caddyfile.snapshot b/deploy/caddy/Caddyfile.snapshot
index e5025a2..aa1bd14 100644
--- a/deploy/caddy/Caddyfile.snapshot
+++ b/deploy/caddy/Caddyfile.snapshot
@@ -58,6 +58,11 @@ upbeatbytes.com {
 	handle {
 		root * /srv/sites/upbeatbytes
 
+		# Hidden in-progress prototypes — keep crawlers out at the HTTP level (the JS
+		# <meta robots> isn't seen by non-JS bots since the static shell is generic).
+		@hidden path /home2 /home3
+		header @hidden X-Robots-Tag "noindex, nofollow"
+
 		# Content-hashed assets never change for a given URL — cache them forever.
 		@immutable path /_app/immutable/*
 		header @immutable Cache-Control "public, max-age=31536000, immutable"