Broken URLs in the sitemap
A sample of the addresses the sitemap lists, fetched to check they still answer. A sitemap full of dead links spends the crawl budget on nothing.
A sitemap that lists pages which no longer exist sends crawlers to error pages. Each such request uses part of the crawl budget that could have gone to real pages, and Search Console reports the sitemap as containing errors. It is also a reliable sign that the sitemap is generated from stale data, a static file nobody regenerated, or a cache that outlived a redesign.
How SiteScan checks it
The scanner picks up to five addresses from the sitemap at random, spread across the file rather than taken from the top, and requests each one. An answer of 400 or higher counts as an error, except 405 and 501, which only mean the server does not support the type of request used. Green "All reachable" means every sampled address answered; red gives the number that failed, and the rows under it list those addresses with their status codes. Because it is a sample, a green row is not proof that the whole file is clean.
How to fix
- Remove deleted pages from the sitemap, or regenerate it from the CMS instead of keeping a static copy.
- For pages that moved, list the new address and redirect the old one with a 301.
- Check the full file in Search Console's Pages report, which lists every listed URL with an error.
See also broken links and soft 404 errors.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Indexing”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data