XML sitemap
The XML list of the addresses the site wants indexed. It does not raise rankings; it makes sure crawlers find out that pages exist.
An XML sitemap is a list of the addresses you want search engines to know about, optionally with the date each one last changed. It does not raise rankings, and it does not force anything into the index. What it does is make sure crawlers discover every page, including ones that few internal links lead to, and notice new or updated pages sooner.
How SiteScan finds and reads it
The scanner looks at the Sitemap: lines in robots.txt first, then at /sitemap.xml and /sitemap_index.xml, and reads the first one that answers (compressed .xml.gz files included).
- Green shows how many URLs it lists. Very large files are read up to 16 MB, and the count then ends in "+".
- Red, "Invalid XML": the file was found but is not a valid sitemap. Search engines reject it entirely.
- Amber, "Missing": none of the addresses returned a sitemap.
Getting it right
- Let the CMS or framework generate it: WordPress has a built-in one at
/wp-sitemap.xml, and SEO plugins add their own. - List only canonical, indexable URLs that answer 200: no redirects, no
noindexpages, no duplicates. - Declare it in robots.txt with
Sitemap: https://example.com/sitemap.xmland submit it in Google Search Console and Bing Webmaster Tools.
More in robots.txt and sitemaps. The rows below cover lastmod dates and whether listed URLs still work.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Indexing”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data