XML Sitemap Guide 2026: Create, Validate & Fix Sitemap

Most “how to create a sitemap” guides stop at “click generate, upload the file.” That gets you a sitemap. It does not get you a sitemap Google trusts, and it will not tell you when the one you already have is quietly costing you crawl budget — which, for most sites reading this, is the more common problem.

We build both ends of this: a sitemap generator and a sitemap validator. So this is not a neutral guide — say that plainly up front — but it is a tested one. Where our tools have real limits, they are in here.

Which situation are you actually in?

If you landed here because your CMS already has a sitemap and you were about to generate a new one anyway, stop — you’d be creating a second, competing file. Validate the one you have instead.

What actually has to be in a sitemap

The sitemaps.org protocol requires exactly one thing per URL: <loc>, the address. Everything else — lastmod, changefreq, priority — is optional, and two of those three are worth skipping entirely.

lastmod is genuinely useful. It tells crawlers when a page last changed, which helps them decide whether to re-fetch it. Keep it accurate — a sitemap where every URL shows today’s date, because a plugin stamps the build time rather than the actual edit time, teaches Google to stop trusting the field.

priority and changefreq are not. Google’s own documentation is direct about this: Google ignores both values. Not “weighs them lightly” — ignores. This has been the stated position since at least 2023, and Google Search Central’s build-a-sitemap page still confirms it as of its most recent update. If your CMS is emitting them on every URL, you’re paying in file size for tags nothing on the receiving end reads.

The hard limits, which are not optional: 50,000 URLs and 50MB uncompressed per file. Go over either, and you need a sitemap index — a parent file listing multiple child sitemaps — rather than one enormous file. Most CMS sitemap plugins handle this split automatically once you cross the threshold.

Where free sitemap generators actually cap you

If you do need to generate one from scratch, the free tools split into two groups: ones that silently stop at a page count, and ones that follow the actual spec limit.

The pattern across the category: a 500-page ceiling shows up often enough that it’s worth checking before you commit ten minutes to any generator, because a mid-size WordPress site with tag pages, category pages, and a few years of posts clears 500 URLs without trying.

The part almost every “sitemap checker” skips

Type “xml sitemap validator” into Google and most of what ranks does the same thing: parse the XML, confirm it’s well-formed, count the URLs, maybe flag a missing lastmod. That is real, but it’s the easy 20% of the problem. None of the popular free validators we checked actually fetch the URLs inside the sitemap to see whether they work.

That distinction matters because the failures that cost real traffic aren’t XML syntax errors:

• A URL in your sitemap now 404s — deleted post, renamed slug, nobody updated the sitemap
• A URL redirects, and Google’s guidance is to list the final destination, not the redirect source
• A URL carries a noindex tag while also sitting in a sitemap that says “please index this” — a direct contradiction Google has to arbitrate
• Your robots.txt blocks a URL your sitemap is actively promoting
• Near-duplicate URLs — /page, /page/, /page?utm_source=x — each listed as if they were distinct pages

What a URL-fetching validator catches that XML parsing can’t

Our sitemap validator fetches every URL — up to 500 by default, 1,000 with the expand toggle — as five separate user agents: Chrome, Googlebot, GPTBot, ClaudeBot, and PerplexityBot. That last part is not vanity. It exists because of a failure pattern specific to 2026.

Your sitemap can be perfect for Google and invisible to AI crawlers

A lot of robots.txt files were edited defensively in 2023 and 2024 — Disallow: / for GPTBot, added during the “block the AI scrapers” moment, when GPTBot was purely a training crawler. That reasoning has aged badly. GPTBot now also powers ChatGPT’s search and browse mode. A robots.txt rule written to stop training scraping in 2023 can now silently mean your site never shows up in a ChatGPT answer in 2026, and most site owners have never gone back to check.

This is genuinely easy to miss, because your Google Search Console dashboard will look completely fine. Googlebot isn’t blocked. Your Google Compliance score is high. Nothing in your normal SEO monitoring flags it, because nothing in your normal SEO monitoring asks the question. Checking robots.txt per crawler — not just per rule — is the only way to catch it.

Sitemap index: when you actually need one

Past 50,000 URLs or 50MB, a single sitemap file is invalid — that part isn’t optional. Under those limits, a sitemap index is still worth using for three practical reasons rather than a hard requirement:

1. Debugging is easier per-section. A /post-sitemap.xml, /page-sitemap.xml, /product-sitemap.xml split means a coverage problem in Search Console points you straight at which content type is affected.
2. Crawl-frequency separation. A file of 10,000 rarely-changing evergreen pages doesn’t need re-fetching as often as one with 100 daily-updated posts. Splitting them lets each get treated on its own schedule.
3. Multi-language sites benefit from per-locale files — /en-sitemap.xml, /fr-sitemap.xml — which, combined with correct hreflang, gives cleaner per-language indexation reporting.

If your CMS already splits by post type — Yoast, Rank Math, WooCommerce, and most static-site generators do this by default — you already have this. Nothing to change.

Fixing what actually shows up in an audit

404 URLs still listed in the sitemap

Either the page was deleted and the sitemap plugin didn’t clean up, or it was renamed and the old slug never got removed. Delete or exclude the source, then regenerate — don’t hand-edit the XML if a plugin owns the file, it’ll just come back on the next build.

A listed URL that redirects

List the final destination instead. If that final URL is also separately listed in the sitemap, you’ve got a redundant duplicate entry burning crawl budget for nothing.

noindex page sitting in the sitemap

Pick one signal. Either the page should be indexed — remove the noindex tag — or it shouldn’t — remove it from the sitemap. Listing it both ways just asks Google to guess.

Sitemap directive missing from robots.txt

One line fixes it: Sitemap: https://yoursite.com/sitemap.xml. This is how every crawler — search or AI — finds the file without you submitting it anywhere manually. Our robots.txt generator handles this alongside the AI-crawler rules above.

Duplicate URLs with tracking parameters

/product/widget, /product/widget?utm_source=email, and /product/widget?ref=partner are one page listed three times. Strip tracking params at the point the sitemap is generated — usually a theme template or custom loop, since standard plugins don’t emit them by default.

What no free tool here can do — including ours

Being straight about this matters more than the sales copy on most competitor pages suggests:

• No free validator checks every URL on a 50,000-page sitemap. Ours caps live URL health checks at 500 (1,000 expanded) — fetching 50,000 URLs across five user agents is 250,000 requests, which is a paid-infrastructure problem, not a free-tool one. We check URLs in file order, which is usually representative enough to catch systemic issues, but it is a sample, not a full audit.
• None of them render JavaScript-injected content the same way a browser does. If your sitemap URLs return an HTML shell and the real content loads via client-side React or Vue, an HTTP-fetch validator sees the shell. So, notably, do GPTBot and PerplexityBot — neither renders JS either — so this is actually the right test for AI visibility, even though it understates what a logged-in human visitor sees.
• Sitemap generation from a URL list can’t discover true orphan pages. If nothing links to a page and it isn’t already in an existing sitemap, no generator — ours included — has a path to find it. That has to be fixed with internal linking, not tooling.

FAQ

Do I need an XML sitemap if my site is small?

Less critical than for a large site, but still useful — it removes any ambiguity about which pages you want indexed, and it’s the fastest path to discovery for a brand-new site with few inbound links yet.

How is a sitemap different from robots.txt?

Opposite jobs. Robots.txt tells crawlers what not to access. A sitemap tells them what you’d like them to find. Neither guarantees indexing — Google still decides that on its own — but a sitemap removes the “we never found it” excuse.

Does submitting a sitemap force Google to re-crawl immediately?

No, and the old ping-URL method that claimed to do this was removed by Google in June 2023. Publishing the file and referencing it in robots.txt is sufficient — Google fetches it on its own schedule.

Will a large sitemap hurt my SEO?

Size itself is neutral — a clean 50,000-URL sitemap is fine. What actually costs you is a sitemap full of 404s, redirects, or noindex pages, because that’s crawl budget spent on nothing.

Do I need priority and changefreq set correctly?

No — Google states plainly that it ignores both. Spend the time on lastmod accuracy and on making sure every listed URL actually returns 200 instead.

My site already has a sitemap from my CMS — should I still check it?

Yes, and this is the more common gap. CMS-generated sitemaps are structurally valid almost by default. They still accumulate 404s, redirect chains, and AI-crawler blocks over time as content changes — which is exactly what a validator that fetches URLs is for.