diff --git a/public/.htaccess b/public/.htaccess
index 8d517d5..3610509 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -280,6 +280,15 @@ AddDefaultCharset utf-8
 ### End: Cross Origin ###
 
 
+# staging.ep-reisen.de shows the TYPO3 13 frontend to backend users only; keep it out of search engines
+<IfModule mod_setenvif.c>
+	<IfModule mod_headers.c>
+		SetEnvIfNoCase Host ^staging\.ep-reisen\.de$ EP_STAGING_HOST
+		Header always set X-Robots-Tag "noindex, nofollow" env=EP_STAGING_HOST
+	</IfModule>
+</IfModule>
+
+
 
 ### Begin: Rewriting and Access ###
 
@@ -303,9 +312,12 @@ AddDefaultCharset utf-8
 	# The frontend lives on www.ep-reisen.de (static export + TYPO3 13); here it would be duplicate
 	# content, so only the backend and the files it loads stay on this host
 	# (original requests only: the index.php hand-over below runs through these rules again)
+	# Logged-in backend users (be_typo_user cookie of this host) see the TYPO3 13 frontend here, to check
+	# pages before they go live on www; the host sends noindex (see the headers section)
 	RewriteCond %{ENV:REDIRECT_STATUS} ^$
 	RewriteCond %{HTTP_HOST} ^staging\.ep-reisen\.de$ [NC]
 	RewriteCond %{REQUEST_URI} !^/(?:typo3|_assets|typo3temp|fileadmin|\.well-known)(?:/|$)
+	RewriteCond %{HTTP_COOKIE} !(?:^|;\s*)be_typo_user=
 	RewriteRule ^ https://www.ep-reisen.de%{REQUEST_URI} [R=301,L]
 	#RewriteCond %{HTTP_HOST} ^www\.example\.com$
 	#RewriteRule .? - [E=TYPO3_CONTEXT:Production]