XML sitemaps: verified best practices and the myths it's time to bury

A sitemap is your site's inventory: an XML file listing the URLs you want search engines to know about, with the date of each one's last real change. That's all it is. And it's worth saying quickly what it is not: Google's official documentation states it plainly — submitting a sitemap does not guarantee indexing. It's a discovery signal, not a command.

What has changed is how much that signal weighs. Bing re-reads sitemaps at least once a day, and in its official blog (July 2025) it said something that redefines the game: sitemap freshness now influences AI-generated answers. The sitemap stopped being technical hygiene and became direct input for generative engines — the territory now called GEO, Generative Engine Optimization.

Which URLs belong in the sitemap (and which don't)

There is exactly one rule: the sitemap lists exactly what you want indexed, and nothing else. Concretely:

In:

• Only canonical URLs — the definitive version of each page, not its duplicates.
• Absolute and same-host — with the full https://; listing URLs from another domain violates the protocol.
• Returning 200 — no redirects, no errors.
• Indexable — no noindex and no robots.txt block.

Out:

• URLs with parameters or session IDs (?color=red&sid=...).
• Staging or pre-production environments.
• Removed (404) or redirected (301) pages.
• URLs with noindex or blocked by robots.txt — a sitemap that asks the engine to index what robots.txt forbids it to read is a contradiction that costs you credibility.

Honest lastmod or nothing

lastmod is the tag that adds the most value — and the one most often faked. Google's position is explicit: use lastmod only if it's consistent and verifiable. If your sitemap says a page changed yesterday when it actually changed years ago, Google eventually stops believing your lastmod — and you lose the signal for the entire site. It's a signal, not a command: a correct lastmod doesn't guarantee an immediate recrawl either.

Bing goes a step further and asks for the full format: ISO 8601 with time and timezone, like 2004-10-01T18:23:17+00:00.

The most common mistake isn't malice, it's the CMS: plugins and generators that stamp the sitemap's generation date on ALL URLs. A sitemap where everything "changed today" is a sitemap that says nothing.

The myths: changefreq, priority and the ghost ping

• changefreq and priority: Google and Bing ignore them. The protocol defines them (priority with a 0.5 default, changefreq from always to never), but both engines have confirmed in their official sources that they don't use them. Writing them does no harm; expecting anything from them does.
• The Google ping is dead. Google announced it in June 2023 and switched it off by the end of that year; today the endpoint returns 404. Note: sitemaps.org still lists the ping as a valid method — on that point it's outdated.

The editorial contrast matters: Google killed unauthenticated push (it was a spam magnet) and kept only the crawler's pull. The Bing ecosystem went the opposite way: it built IndexNow, a push authenticated with a per-domain key. That's why IndexNow requires verification — and that's why it works.

Limits and the sitemap index

The protocol's numbers are generous, but they exist:

• 50,000 URLs or 50 MB uncompressed per sitemap file.
• Got more? Use a sitemap index: a file that groups up to 50,000 sitemaps.
• Reference it in robots.txt with the Sitemap: https://yourstore.com/sitemap.xml directive — still a valid discovery method for Google and Bing.

Connect both consoles (yes, both)

In Google Search Console the drill is familiar:

1. Add the property and verify the domain.
2. In the Sitemaps section, submit your sitemap's URL.
3. Use the page indexing report to see how many URLs made it in, how many stayed out and why.

Bing Webmaster Tools is the step almost everyone skips, and today it counts double: Bing's index is the base ChatGPT and Copilot use to answer fresh searches. Not being there means giving up that entire channel. The good news: Bing lets you import your site from Google Search Console in one click — it brings over the verification and the sitemaps you already submitted, nothing to repeat.

The extra incentive is recent: the AI Performance report in Bing Webmaster Tools (in beta since February 2026, expanded in June 2026) shows your site's citations in Copilot — the first official analytics for visibility in AI answers. Honesty required: it covers only the Microsoft ecosystem; it doesn't report citations from ChatGPT, Perplexity or Gemini.

And one more honest note: being in the index isn't enough if bots can't read you. If your firewall or CDN challenges AI crawlers, everything above is voided — check it in the guide to accessibility and indexing for AI bots.

Pull + push: the sitemap doesn't compete with IndexNow

What's left is a two-speed model worth keeping clear:

• The sitemap is pull: the full inventory the engine re-reads every so often (Bing, at least once a day). Typical latency: hours to days. It gives you coverage and recovery — if the engine loses track, the sitemap rebuilds it.
• IndexNow is push: an instant per-URL notice at the exact moment of the change. Latency: minutes.

They don't compete: the sitemap is your map; IndexNow, your emergency channel. For a store, emergencies are daily: prices, stock, product additions and removals. That's where IndexNow Connect closes the loop — it listens to every addition, change and removal in your catalog and fires the IndexNow notice automatically, without touching your store's code, while your sitemap remains the background inventory.

A tip for domains on Cloudflare: the Crawler Hints feature already emits IndexNow notices passively when your content changes — how to enable it is in the Cloudflare technical guide for SEO and GEO.

Common mistakes in store sitemaps

The five we see most:

1. Discontinued products still listed — the URL returns 404 or redirects, but the sitemap keeps offering it.
2. Variants with parameters — ?size=42 is not a canonical URL and doesn't belong in the sitemap.
3. Leaked staging — test URLs that slipped into the production sitemap.
4. A sitemap that contradicts robots.txt — listing what you're simultaneously blocking.
5. A lying lastmod — the generation date stamped on every URL.

Frequently asked questions

Do I need a sitemap if my store is small?

You probably don't need one: Google's guidance is that a well-linked site under ~500 pages can do without it. But it's worth having anyway: most platforms auto-generate it for free, it's a practical requirement for the consoles, and it's the freshness signal Bing re-reads daily.

How often does Bing read my sitemap?

At least once a day, according to its official blog from July 2025. That's why an honest lastmod pays off: every re-read tells Bing exactly what changed without it having to crawl your whole site.

Is manually resubmitting the sitemap worth it?

Almost never. Search engines re-read it on their own, and manual resubmission forces no recrawl. If you need speed for specific URLs, that's push work: IndexNow, not the sitemap.

Does the sitemap guarantee indexing?

No, and Google's own documentation says so. The sitemap helps discovery; final indexing depends on each page's quality, authority and technical health. The same goes for IndexNow: notifying doesn't force indexing.

What do I do with out-of-stock products?

It depends on whether the URL is still alive. An out-of-stock product whose page returns 200 can stay in the sitemap — it sells again when you restock. A deleted product (404 or redirect) has to leave the sitemap, and it's worth notifying the removal via IndexNow so the index stops showing something that no longer exists.

Connect your store for free → — every addition, change and removal in your catalog notified to Bing in real time, with 500 free URLs per month.