When convenient
Search engines are allowed to index everything on your site
This is the exact wording EverThread uses when it finds this on a customer's site, written for someone who runs a business, not a server. The example site here is yourbakery.com.
What we saw
Your robots.txt exists but blocks nothing.
Why it matters
Login pages, admin areas and search-result pages end up in Google, which is where attackers go looking for them.
How to fix it
Ask your developer to add Disallow lines for admin, login and account pages.
For your developer
robots.txt has zero Disallow rules. Add rules for /wp-admin, /admin, /login, /account, internal search, etc.