My colleague claims that he has seen cases where websites were "discovered" by Google without having a link to them anywhere on the web.
For him, this means that the only way to not being indexed (for example when a website being developed is already online, but not ready to be used by customers yet) is to restrict the access to the files on the server with a password.
How can Google find a website without following links? If for some reason the site is discovered, isn't robots.txt and a global
<meta name="robots" content="noindex"> (on every page) enough?