We’re seeing visitors accessing /a.html, /b.html, c.html versions of our landing pages. Accessing <landing_page_url>/b.html responds with a 200 response and renders the content of the B variant for the landing page. There’s also no robots tag to prevent this URL from being indexed / followed. Google Analytics is also tracking entrances to these URLs and we can’t identify how anyone would know these URLs even exist.

So my question is, how do we stop visitors from accessing these variant specific URLs or at least prevent them from being indexed in Google / other search engines?