Sitemap index file
A sitemap that points at other sitemaps. Sites past 50,000 addresses have to be split this way.
A sitemap index is a sitemap of sitemaps: instead of <url> entries it contains <sitemap> entries, each pointing to another sitemap file. The protocol limits a single sitemap to 50,000 URLs and 50 MB uncompressed, so any larger site has to split its list. Many CMSs and SEO plugins split it even for small sites, one file per content type (pages, posts, products, categories), which also makes problems easier to locate in Search Console.
How SiteScan shows it
When the sitemap found is an index, this row appears with the number of child sitemaps it lists. It is informational and always green: an index is a normal, correct structure. To keep the scan fast, only the first child sitemap is opened, so the URL count in the sitemap row describes that one file, not the whole site.
Good practice
- Submit only the index to Google Search Console and Bing; they will fetch the children themselves.
- Each child must be on the same host as the index and must itself be a valid sitemap, not another index (nesting is not allowed).
- Remove children that no longer exist: an index that points to missing files produces errors in Search Console.
- Use
<lastmod>on each<sitemap>entry so crawlers know which files changed.
See also the sitemap row and robots.txt and sitemaps.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Indexing”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data