Securealy
Check · SEO · medium · passive

Sitemap present and healthy

/sitemap.xml returns 200 and a sample of its URLs return 200.

Severity
medium
Tier
Passive: runs on any URL
Category
SEO
Fix
Summary below; full runbook in the Fix Kit, Module 02: Be found
Id
sitemap

What this means

Your sitemap, at the URL named in robots.txt or at /sitemap.xml, returns 200 as XML, parses, and the pages it lists return 200 themselves. It is the list of URLs you are asking search engines to index. Failing means the sitemap is missing, is an HTML page served as 200, does not parse, or lists URLs that no longer return 200.

How we test it

We read the Sitemap: line from your robots.txt and fall back to /sitemap.xml, following at most 3 redirects. We require a 200 status with an XML content type and a document that parses, following child sitemaps if it is an index. We then fetch a sample of the listed URLs and require each to return 200 directly; a missing or unparseable sitemap, or sampled URLs that return anything other than 200, fails.

Why it matters

Sitemaps with dead URLs waste crawl budget and signal neglect. Every URL you list is a promise, and a crawler that keeps finding 404s and redirects behind that promise trusts the file less. In one case from the kit, a pattern-based redirect rule matched the shape of a live route, every live event page redirected to its parent hub for three days, hundreds of indexed pages vanished from search, and the ranking recovery took weeks after a five-minute fix. The kit also warns that a sitemap generated through an API that caps results at 1,000 rows silently stops at 1,000 pages while reporting nothing wrong.

The fix

Serve the sitemap at /sitemap.xml with an application/xml or text/xml content type, generated from the same data that renders the pages and paging through every row rather than stopping at an API cap, with redirects coming from an exact-match table and never a pattern. Then run node scripts/seo-audit.mjs https://YOUR_DOMAIN/sitemap.xml, which fetches every listed URL, prints the count to compare against your database, and exits non-zero until the output ends with N urls, 0 failures. The full runbook is in the Fix Kit, Module 02.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything yet. This is a verification pass only.
Run: curl -s https://YOUR_DOMAIN/robots.txt | grep -i "^Sitemap:" and print the URL it names, or note that none is named.
Run: curl -sIL --max-redirs 3 https://YOUR_DOMAIN/sitemap.xml | grep -iE "^(HTTP|content-type)"
Run: curl -sL https://YOUR_DOMAIN/sitemap.xml | grep -c "<loc>" and print the URL count.
Take the first 10 URLs from the sitemap and run curl -s -o /dev/null -w '%{http_code} %{url_effective}\n' on each without following redirects.
Print every URL whose status is not 200.
Find the code or file that generates the sitemap and tell me whether it pages through all records or stops at a fixed limit.
List what it would take to make every listed URL return 200, without editing anything.
Verify: the sitemap returns 200 with an xml content type and all 10 sampled URLs print 200; if any do not, report them and stop.

Next

Grade your own URL

Every grade lists this check with its evidence for your site. Two free grades a day.