Free instant website audit · 190,000+ sites checked · no card, no account
Custom Web Audits
← All free tools
🗺️

XML Sitemap Validator

Validate any XML sitemap (or sitemap index): confirm it is well-formed, count the URLs, flag duplicates and insecure http:// links, and check it stays under Google's 50,000-URL / 50 MB limits before you submit it.

⚡ Interactive demo — sample data
Valid XML urlset with 12,480 URLs — 2 issues to clean up before submitting.
Format — valid <urlset> (URL set), well-formed XML Looks good
URLs — 12,480 entries, under the 50,000-URL limit Looks good
File size — 4.7 MB, under the 50 MB uncompressed limit Looks good
Duplicate URLs — 36 pages listed more than once; dedupe across the set Issue
Insecure URLs — 14 http:// links; switch to the final https:// version Warning
<lastmod> dates — 12,480 present, helps crawl scheduling Looks good

About this tool

Validate any XML sitemap (or sitemap index): confirm it is well-formed, count the URLs, flag duplicates and insecure http:// links, and check it stays under Google's 50,000-URL / 50 MB limits before you submit it.

How it works

Enter your sitemap URL or domain
Paste the full sitemap URL (e.g. https://example.com/sitemap.xml). If you give us just a domain, we look for /sitemap.xml at the root automatically — the conventional location search engines check first.
We fetch and parse the XML
We download the file and parse it as real XML. We detect whether it's a <urlset> (a list of pages) or a <sitemapindex> (a list of other sitemaps), then count every <loc> entry and read the <lastmod> dates inside.
Review the validation report and fix
You get a pass/fail on well-formed XML, the URL count, the 50,000-URL and 50 MB limits, duplicate URLs and insecure http:// links. Fix anything flagged, then submit the clean file to Google Search Console and Bing Webmaster Tools.

What we check

  • Well-formed XML — Parses the file with a strict XML parser. A single unescaped & or < , an unclosed tag, or a stray BOM will break parsing — and a sitemap that doesn't parse is rejected outright by search engines. We tell you exactly where it failed.
  • Root element type — Confirms the root is a valid <urlset> (page list) or <sitemapindex> (a list of child sitemaps). An unexpected root element means the file isn't a sitemap search engines recognize, even if the XML itself is technically valid.
  • URL count vs the 50,000 limit — Counts every <loc> entry. A single sitemap may contain at most 50,000 URLs. Over that, you must split into multiple sitemaps and reference them from a sitemap index file — we flag it when you're over.
  • File size vs the 50 MB limit — Measures the uncompressed size. The hard cap is 50 MB (52,428,800 bytes) uncompressed per file. You can gzip a sitemap for transfer, but the uncompressed content must still stay under 50 MB or it gets rejected.
  • Duplicate URLs — Compares every <loc> value and flags repeats. Duplicates waste crawl budget and muddy which URL you actually want indexed. Each page should appear exactly once across your sitemaps.
  • Insecure http:// URLs — Counts <loc> entries that start with http:// instead of https://. On an HTTPS site these create redirect hops and mixed signals — every listed URL should be the final, canonical https:// version.
  • <lastmod> presence — Reports how many entries carry a <lastmod> date. It's optional, but an accurate W3C-format date (e.g. 2026-06-23) helps search engines schedule re-crawls and prioritize pages that actually changed.

Common issues we catch

  • More than 50,000 URLs in one file — The 50,000-URL ceiling is per sitemap, not per site. The fix isn't to trim pages — it's to split into several sitemaps (e.g. /sitemap-1.xml, /sitemap-2.xml) and list them in a <sitemapindex> file, which can itself reference up to 50,000 sitemaps.
  • File over 50 MB uncompressed — Long URLs and lots of optional tags (<lastmod>, <changefreq>, <priority>) inflate size fast. Gzipping helps transfer but the limit is on the uncompressed content. If you're over, split the file — same as the URL-count fix.
  • Malformed XML from unescaped characters — Raw &, <, > or " inside a <loc> URL (common with query strings like ?a=1&b=2) breaks the parse. They must be entity-encoded (&amp;, &lt;, etc.). One bad character can invalidate the entire file.
  • Duplicate URLs across split sitemaps — When a site splits its sitemap, the same URL sometimes lands in two child files — easy to miss because each file looks fine alone. Search engines see the duplication across the set, so dedupe globally, not just per file.
  • http:// URLs on an HTTPS site — After an HTTPS migration the sitemap often still lists the old http:// URLs. Every one becomes a redirect, diluting crawl efficiency and sending a mixed canonical signal. List only the final https:// URLs you actually want indexed.
  • Listing non-canonical, blocked, or noindex URLs — A sitemap should contain only the canonical, indexable version of each page. Including redirected, robots-blocked, noindexed or parameter-variant URLs sends conflicting signals — telling search engines to index pages you've told them elsewhere to ignore.
  • A urlset where you needed a sitemapindex (or vice versa) — Pointing search engines at a plain <urlset> when you meant to give them a master <sitemapindex> — or nesting <url> entries under a <sitemapindex> — produces a structurally wrong file. The root element must match the content: <urlset> holds <url>/<loc>; <sitemapindex> holds <sitemap>/<loc>.

Where this matters

  • Google Search Console — Submit your sitemap (or sitemap index) under Indexing → Sitemaps. Google reports its own parse status and discovered URL count there, so a file that passes here should submit cleanly. A single index file can point to all your child sitemaps.
  • Bing Webmaster Tools — Bing reads the same XML sitemap format and enforces the same 50,000-URL / 50 MB limits. Submit the file in Bing Webmaster Tools so Bing — and the engines that draw on its index — discover your pages.
  • Sitemap index files — For large sites, a <sitemapindex> lists multiple child sitemaps so you stay under the per-file limits. We detect index files and count the child sitemaps instead of pages, so you validate the structure at the right level.
  • WordPress, Shopify & sitemap plugins — CMS platforms and SEO plugins (Yoast, Rank Math, the built-in WordPress sitemap) auto-generate sitemaps — and auto-generate the bugs too: stale URLs, duplicates after a URL change, or noindexed pages still listed. This catches those before submission.

Frequently asked questions

What is an XML sitemap?
An XML sitemap is a file that lists the URLs on your site you want search engines to discover, wrapped in a <urlset> root with one <url> entry per page. Each entry has a required <loc> (the URL) and optional <lastmod>, <changefreq> and <priority> tags. It helps crawlers find pages they might otherwise miss.
How many URLs can a sitemap have?
A single sitemap file can contain a maximum of 50,000 URLs and must stay under 50 MB uncompressed. If your site is larger, split your URLs across multiple sitemaps and list them in a sitemap index file, which can itself reference up to 50,000 sitemaps.
What's the difference between a urlset and a sitemapindex?
A <urlset> is a sitemap that lists actual page URLs. A <sitemapindex> is a master file that lists other sitemaps rather than pages — used by large sites to stay under the 50,000-URL limit. The root element tells search engines which kind of file they're reading.
Do I need lastmod, changefreq and priority?
Only <loc> is required. <lastmod> is genuinely useful — an accurate last-modified date helps search engines decide when to re-crawl. Google largely ignores <changefreq> and <priority> today, so don't agonize over them; an honest <lastmod> is worth far more.
Why does my sitemap fail to validate as XML?
The most common cause is an unescaped special character inside a URL — an ampersand from a query string (&) must be written as &amp;, and the same goes for <, > and quotes. An unclosed tag or a leading byte-order mark will also break parsing. Fix the offending character and the file will parse.
Should sitemap URLs be http or https?
Use https:// if your site runs on HTTPS. Listing http:// URLs forces a redirect to the secure version on every crawl and sends a mixed canonical signal. Every <loc> should be the final, canonical https:// URL you actually want indexed.
Where do I submit my sitemap?
Submit it in Google Search Console (Indexing → Sitemaps) and Bing Webmaster Tools. You can also add a Sitemap: line pointing to its full URL in your robots.txt so crawlers discover it on their own. For large sites, submit one sitemap index file rather than each child sitemap.
How often should I update my sitemap?
Whenever your URL set changes — new pages, removed pages, or significant content updates. Most CMS platforms and SEO plugins regenerate it automatically. The key is accuracy: a stale sitemap full of dead or redirected URLs is worse than a smaller, current one.

This is one of several free SEO tools from Custom Web Audits. For a complete, prioritized analysis of your whole website, run a full audit.