WordPress XML Sitemaps: What to Include, Exclude and Verify

A WordPress XML sitemap should list every URL you want indexed and nothing else: canonical addresses that return 200, carry no noindex, and have an honest lastmod, plus image entries where images matter. Keep noindexed pages, thin archives, attachment pages, paginated fragments and parameterised duplicates out of it. Then submit the sitemap index once in Google Search Console and monitor it there — the per-sitemap report, not the submission, is where the useful information lives.

A disclosure before the plugin numbers: RankWave AI and Hydrogen SEO are both built by Sheesh Labs, so one of the seven plugins measured below is a sister product. Read it as a builder's write-up rather than a neutral review. Hydrogen SEO is Beta software and it did not win the sitemap category.

What is an XML sitemap for (and what is it not for)?

A sitemap is a machine-readable list of URLs you are inviting crawlers to visit, annotated with when each last changed. It solves a discovery problem: on a large site, or one where new articles sit four clicks from the homepage, link-following alone takes a long while to reach fresh content.

What it is not matters just as much, because most sitemap mistakes start there:

• Not a ranking factor. Being listed makes a page findable sooner. It does not make it better.
• Not an indexing command. Google treats a sitemap as a strong hint. Listed pages get skipped; unlisted pages get indexed through links.
• Not a replacement for internal links. A page only the sitemap points at is an orphan, and orphans behave like orphans however neatly they are listed.

What belongs in a WordPress sitemap?

One rule covers it: a URL belongs in the sitemap if, and only if, you want it indexed and it is capable of being indexed. Four checks apply that rule.

• Canonical. The address you chose for that content, matching the page's own canonical tag — not a variant or an alternate route to the same words.
• Indexable. No noindex robots meta, and not disallowed in robots.txt.
• Returns 200. Live. Not a redirect, not a soft 404, not a page that errors for logged-out visitors.
• Worth landing on. Something a searcher could arrive at and be satisfied by.

For a typical install that means posts, pages, custom post types carrying real content, and the taxonomy archives with genuine browsing value. Well-populated category archives usually qualify; tag archives with two posts each usually do not. The rest of the technical housekeeping is in the 25-point WordPress SEO checklist for 2026. Size limits rarely bite, but know them: the protocol caps one file at 50,000 URLs and 50MB uncompressed, and the reason to split earlier is legibility rather than the limit.

What should never be in a WordPress sitemap?

Each of these sends a crawler a wasteful or self-contradictory signal:

• Noindexed URLs. The sitemap says index this; the robots meta says do not. Search Console reports the contradiction, and you have spent crawl attention arguing with yourself.
• Redirecting URLs. Sitemaps list destinations. Old addresses belong in redirect rules — see 301 redirects in WordPress without building redirect chains.
• Attachment pages. The bare page WordPress wraps around a single media file is classic thin content.
• Paginated duplicates. /page/2/ of an archive, and comment-pagination URLs, are fragments of a set rather than destinations.
• Parameterised variants. ?sort=price, ?utm_source=…, filter and session parameters: alternate doors to a page that already has one true URL.
• Utility pages. Cart, checkout, login, thank-you screens, internal search results.

Why does lastmod matter, and why does a fake lastmod hurt?

lastmod tells crawlers when a URL's content genuinely changed. Google has said publicly that it uses the field where a site has proven it trustworthy and ignores it where the site has not, which makes it less a setting than a credit rating.

You earn credit when lastmod moves only on real edits, so a crawler that returns finds something different. You spend it when every URL claims today's date every day — usually a misconfiguration or a bulk touch-update, occasionally a deliberate tactic. Crawlers find nothing changed and the field stops carrying weight sitewide. The cost is not a penalty; it is losing the one mechanism that gets genuinely updated pages recrawled quickly.

The honest configuration is dull. Let lastmod reflect the real modified date, never re-save posts to manufacture freshness, and accept that a page untouched since 2024 says so. As for priority and changefreq, Google largely ignores both.

Should images be in the sitemap?

If image search sends you traffic, or could — recipes, products, portfolios, tutorials with diagrams — then yes. The protocol allows image entries attached to a page URL, which amounts to telling crawlers "this page contains these images". It matters most when images load in ways crawlers parse poorly, such as lazy-loaded galleries. Discovery is only half the job, though: an image found through the sitemap still needs descriptive alt text before anything can work out what it shows.

How do WordPress SEO plugins differ on sitemaps?

More than you would expect. The Hydrogen SEO benchmark of seven WordPress SEO plugins, re-run on 8 September 2026, followed each sitemap index into every child file and counted what was actually there, on a WordPress 7.1 install with 40 posts and 8 pages, one plugin at a time at its own defaults.

Every one declared its sitemap in robots.txt and produced valid XML, so the differences are editorial rather than technical. Yoast listed the most URLs. Hydrogen SEO stamped all 72 of its URLs with a lastmod and shipped image entries, which no other plugin managed together. Rank Math includes images by default but not featured images, so a site whose images are featured images gets none until that setting changes; it also omits tag and author archives, hence 59 URLs. The SEO Framework takes the strongest position: a flat file, no index, posts and pages only. Slim SEO and SEOPress left roughly a third of their URLs unstamped, and WordPress core 23 of 74.

None of those defaults is wrong, but they are choices made on your behalf. If you assumed your tag archives were submitted, or your product photos were in image search, open your own sitemap and count. The wider cost picture — PHP time, queries, database tables — is in the fastest WordPress SEO plugin benchmark; three of these plugins are compared on output and price on our sister site in Hydrogen SEO vs All in One SEO vs SEOPress.

Hydrogen SEO generates its index, per-type children, image entries and exclusions with no account and no licence key; the setup is documented in the Hydrogen SEO XML sitemaps documentation, and we cover the plugin on our Hydrogen SEO page.

How do you submit and verify a sitemap in Google Search Console?

Submission is a one-off act. Verification is the ongoing job.

1. Find the real URL. Copy it from your plugin's sitemap screen rather than guessing — as the table shows, the entry point differs by plugin.
2. Open it as a crawler would. In a private window or with curl, over HTTPS, on the canonical hostname. The wp-admin preview can look perfect while the public file is stale or blocked.
3. Submit the index. In Search Console, go to Indexing → Sitemaps and paste the index URL, not each child. The walkthrough is in Hydrogen SEO's guide to submitting your sitemap to Google.
4. Then stop submitting and start reading. Google refetches on its own schedule; resubmitting daily accomplishes nothing.

Check monthly for fetch or parse errors on the index or any child, for the gap between discovered and indexed URLs per child, and for findings that the sitemap contains noindexed or redirecting URLs — that last one always means your sitemap and your site disagree.

The discovered-versus-indexed gap is the most misread number in the report. If a child shows most URLs discovered but few indexed, the sitemap did its job and the problem is quality, duplication or thinness in that content type. No sitemap change will fix it.

How do you troubleshoot a sitemap Google is not reading?

Work through the causes in order of likelihood.

"Couldn't fetch" in Search Console

Fetch the exact URL yourself, from outside your network, over HTTPS: a typo or an http/https mismatch is the most common cause by a distance. Then check for blocking, since a firewall rule, bot protection or an over-broad Disallow can stop Googlebot while letting your browser through. If both are clean, wait — the status often appears right after submission and clears once Google actually crawls the file. Resubmit after a real fix, not before.

Mismatched URLs

The addresses inside the sitemap must match the canonical form exactly: same protocol, same www or non-www host, same trailing-slash convention. A sitemap listing http:// URLs after an HTTPS migration, or the old domain after a move, almost always means a stale site URL setting or a copy cached before the switch. Redirecting entries are not fatal, but they waste every crawl they earn.

The index versus its children

An index that fetches fine while nothing gets indexed usually means a child is the problem: one 404ing, one empty, one listing a handful of URLs where you expected hundreds. Open each directly. An empty child is nearly always intentional filtering doing more than you meant — an exclusion set and forgotten, a site-wide noindex, or a post type that is not publicly queryable. Drafts and private posts never appear, by design.

CDATA-wrapped <loc> values and other parser surprises

Some generators wrap URLs as <loc><![CDATA[https://example.com/post/]]></loc>. That is valid XML and search engines handle it, but the quick script or spreadsheet you wrote to diff your sitemap against your post list may not, producing a convincing panic about URLs that are sitting right there. Check the raw file before believing your own tooling.

The genuinely broken case looks different: a parse error such as "XML declaration allowed only at the start" means something printed whitespace or a UTF-8 byte-order mark before the XML began, typically a blank line in a theme's functions.php or a file saved as UTF-8 with BOM. The sitemap is fine; other code is polluting the response, and it breaks every XML file the site serves.

Stale caches, the near-universal culprit

If the sitemap is simply out of date, work outward: clear the plugin's sitemap cache, then the page cache, then the CDN. Sitemaps are cheap to generate and expensive to serve stale, so excluding sitemap paths from long-lived caching is usually the right permanent fix. The ordered checklist, including multisite and staging cases, is in the Hydrogen SEO sitemap troubleshooting guide; the broader argument for sitemap honesty is in what your XML sitemap is really telling Google.

The short version

Canonical, indexable, 200-status URLs only. No noindexed pages, attachment pages, paginated fragments or parameter variants. An index split by content type, so Search Console can tell you which type has the problem. Image entries where images earn traffic. A lastmod you would defend. Submitted once, read monthly, caches cleared the moment the XML and reality disagree.