Your files never leave your device. All processing happens locally in your browser.
How do I validate an XML sitemap against the sitemaps.org protocol and Google’s rules without uploading it?
Open AnyTool’s XML Sitemap Validator, paste your sitemap.xml contents, and it parses the XML with the browser’s own DOMParser and checks it against the sitemaps.org 0.9 protocol and Google’s documented rules and limits — all in your browser. It detects whether the root is a <urlset> (page URLs) or a <sitemapindex> (a list of child sitemaps) and confirms the required namespace http://www.sitemaps.org/schemas/sitemap/0.9. For each <url> it checks that <loc> is present, is a single absolute http(s) URL, is at most 2,048 characters and is entity-escaped (every & written as &amp;), plus optional <lastmod> (a valid W3C Datetime), <changefreq> (always/hourly/daily/weekly/monthly/yearly/never) and <priority> (0.0–1.0). It enforces the hard limits — no more than 50,000 entries and 50 MB uncompressed per file — and flags stray or unknown tags. You get a grouped errors / warnings / info report plus a URL-list preview. It validates STRUCTURE and FORMAT — it does not crawl your site or verify each URL returns HTTP 200 — and note that Google now ignores <priority> and <changefreq>.
Paste your sitemap.xml — parsed locally with the browser’s DOMParser, nothing uploaded
Detects <urlset> vs <sitemapindex> and checks the sitemaps.org 0.9 namespace
Enforces the 50,000-URL and 50 MB limits; flags stray / unknown tags and duplicate URLs
Structure/format only — it does not confirm each URL returns 200; Google ignores priority & changefreq
What is
XML sitemap validation
XML sitemap validation is the process of checking that a sitemap file conforms to the sitemaps.org 0.9 protocol and a search engine’s rules. A valid sitemap has a <urlset> root (for page URLs) or a <sitemapindex> root (for a list of child sitemaps) declaring the namespace http://www.sitemaps.org/schemas/sitemap/0.9; every entry has a required <loc> (a single absolute URL, at most 2,048 characters, with XML special characters entity-escaped), and may add an optional <lastmod> (a W3C Datetime), <changefreq> and <priority>. A single file must contain no more than 50,000 URLs and be no larger than 50 MB uncompressed; larger sites split into multiple sitemaps referenced by a sitemap index.
That the XML is well-formed and matches the sitemaps.org protocol: the right root and namespace, one absolute <loc> per entry (≤ 2,048 chars, escaped), valid lastmod / changefreq / priority, and the 50,000-URL / 50 MB limits.
It parses the XML with the browser’s DOMParser to catch any malformed markup (an un-escaped & is the most common cause), then validates against the sitemaps.org 0.9 protocol and Google’s rules. It confirms the root is <urlset> or <sitemapindex> and declares the namespace http://www.sitemaps.org/schemas/sitemap/0.9. For each <url> it requires exactly one <loc> that is a single absolute http(s) URL of at most 2,048 characters, and validates the optional <lastmod> as a W3C Datetime (YYYY-MM-DD or a full ISO 8601 timestamp with a timezone), <changefreq> against the allowed set, and <priority> as a number from 0.0 to 1.0. It enforces the hard limits of 50,000 entries and 50 MB uncompressed per file, flags stray or unknown tags and duplicate URLs, and for a sitemap index validates each <sitemap><loc>. It checks structure and format — not whether each URL returns HTTP 200.
A <urlset> lists your actual page URLs; a <sitemapindex> lists other sitemap files. You use an index when you exceed 50,000 URLs or 50 MB and must split into multiple sitemaps.
A regular sitemap has a <urlset> root and contains one <url> entry per page, each with a <loc> and optional <lastmod> / <changefreq> / <priority>. A sitemap index has a <sitemapindex> root and contains <sitemap> entries, each pointing with a <loc> to a child sitemap file (plus an optional <lastmod>) — changefreq and priority are not valid inside an index entry. Because a single sitemap file is capped at 50,000 URLs and 50 MB uncompressed, large sites split their URLs across multiple sitemaps and list those files in one sitemap index, which can itself reference up to 50,000 sitemaps. The validator auto-detects which type you pasted and applies the correct rules.
lastmod must be a W3C Datetime — YYYY-MM-DD or a full ISO 8601 timestamp with a timezone. Google now ignores changefreq and priority; only an accurate lastmod influences crawling.
<lastmod> must follow the W3C Datetime format: a date like 2026-06-15, or a full timestamp like 2026-06-15T09:30:00+00:00 (a time requires a timezone designator — Z or ±hh:mm). The validator flags a plain space instead of the ISO “T” separator or a missing timezone. <changefreq> must be one of always, hourly, daily, weekly, monthly, yearly or never, and <priority> a decimal between 0.0 and 1.0 — but Google has confirmed it ignores both of them, and only uses <lastmod> when it is consistently and verifiably accurate. So the tool validates all three, but adds an info note that priority and changefreq have no effect on Google (they are harmless to keep).
Paste the XML. Your browser can’t fetch most live URLs (cross-origin / CORS) and there’s no server proxy, so open your sitemap, copy its contents and paste them in.
Because the tool is 100% client-side with no server proxy — which is what keeps your data private — your browser can only fetch sitemaps that explicitly allow cross-origin requests (CORS) or are same-origin. Almost all live sites block that, so the reliable path is to open your sitemap (usually /sitemap.xml), select all, copy and paste it in. The optional “try to fetch” box is there for the rare CORS-enabled case; when it fails, it tells you to paste the XML instead. Nothing you paste is ever uploaded, which makes the tool safe for staging or internal sitemaps. Remember it validates structure and format — to confirm each URL resolves to a live 200 page, use a site crawler, and submit and monitor the sitemap in Google Search Console.
Detailed Explanation
📖How It Works
What the XML Sitemap Validator Checks
The XML Sitemap Validator takes the contents of a sitemap the user PASTES and validates it against the sitemaps.org 0.9 protocol and Google’s documented rules and limits, entirely in the browser. It first parses the text with the browser’s own DOMParser in XML mode, which surfaces any well-formedness error — most commonly an un-escaped ampersand, since every & in a URL must be written as &amp; (and < > " ' as &lt; &gt; &quot; &apos;). It then detects the sitemap TYPE from the root element: a <urlset> lists your actual page URLs, while a <sitemapindex> lists other sitemap files; either root must declare the namespace http://www.sitemaps.org/schemas/sitemap/0.9 (http, not https, and no trailing slash — a wrong namespace is rejected by search engines). For a <urlset> it validates each <url>: exactly one <loc> that is a single absolute http(s) URL of at most 2,048 characters; an optional <lastmod> that must be a W3C Datetime; an optional <changefreq> from the fixed set; and an optional <priority> between 0.0 and 1.0. For a <sitemapindex> it validates each <sitemap> entry (a required <loc> plus optional <lastmod>, with changefreq/priority rejected). It enforces the hard limits — no more than 50,000 entries and 50 MB uncompressed per file — and flags stray or unknown tags and duplicate URLs.
Paste your sitemap.xml — validated locally, nothing uploaded or crawled
Detects <urlset> (page URLs) vs <sitemapindex> (child sitemaps) and checks the 0.9 namespace
Per <url>: <loc> present / single / absolute / ≤ 2,048 chars / escaped
Enforces the 50,000-entry and 50 MB-uncompressed per-file limits
⚙️Methodology
How It Validates Each Rule
A small, pure, well-typed engine, sitemapValidateEngine.ts, does the work with the browser’s DOMParser and plain JavaScript — no dependency and no network. It reads the parsed document’s root, strips any namespace prefix to compare the local name against urlset / sitemapindex, and reads the xmlns attribute for an exact namespace match. It measures the input’s UTF-8 byte length with TextEncoder to test the 50 MB uncompressed limit, and counts entries against the 50,000 cap (warning once you pass 45,000). For each <loc> it uses the browser’s URL parser to require an absolute http(s) URL, checks the 2,048-character limit, and tracks the host so it can warn when one sitemap spans multiple hosts (sitemaps.org recommends a single host). Its validateW3CDate() accepts the W3C Datetime forms the protocol allows — a date like 2026-06-15 or a full ISO 8601 timestamp such as 2026-06-15T09:30:00+00:00 — and specifically catches the two common mistakes: a time without a timezone designator (Z or ±hh:mm), and a space used instead of the ISO “T” separator. <changefreq> is matched (case-insensitively) against always/hourly/daily/weekly/monthly/yearly/never, and <priority> is parsed as a number and range-checked to 0.0–1.0. Findings are grouped into errors, warnings and info, each pinned to the offending entry index with a concrete fix, and the page also shows a URL-list preview with each <loc> and its lastmod / changefreq / priority.
Parses with the browser’s DOMParser and detects <parsererror> for malformed XML
Absolute-URL and length checks via the browser’s URL parser; UTF-8 size via TextEncoder
W3C Datetime validator catches missing timezone and space-instead-of-“T” mistakes
changefreq matched to the 7-value set; priority parsed and range-checked to 0.0–1.0
Findings grouped error / warning / info, pinned to the entry index, with a concrete fix each
⚠️Limitations
Structure, Not Live 200s — Paste the XML (CORS), and Google Ignores Priority
The tool is explicit about three honest limits. First, it validates STRUCTURE and FORMAT — it does NOT crawl your site or confirm that each <loc> URL returns HTTP 200; a sitemap can be perfectly valid XML yet list dead or redirected URLs, so a site crawler is the right tool to verify each URL resolves. Second, paste the sitemap CONTENTS: because the tool is 100% client-side with NO server proxy (which is what keeps your data private), your browser can only fetch CORS-enabled or same-origin sitemaps — almost all live sites block cross-origin requests, so the reliable path is to open your sitemap (usually /sitemap.xml), select all, copy and paste; the optional “try to fetch” box is only for the rare CORS-enabled case and, on failure, tells you to paste instead. Third, although the validator checks <priority> and <changefreq> against the protocol, Google has confirmed it now IGNORES both — only an accurate, verifiable <lastmod> influences its crawling — so the tool adds an info note that those two fields have no effect on Google (they are harmless to keep). It also notes that a valid sitemap should still be submitted and monitored in Google Search Console, where the Sitemaps report shows fetch status and any errors Google itself finds.
Validates structure/format only — it does NOT verify each URL returns HTTP 200 (use a crawler)
Paste the XML — browser can’t fetch most live sitemaps (CORS); no server proxy keeps it private
Google ignores <priority> and <changefreq>; only an accurate <lastmod> influences crawling
Wrong namespace (https / trailing slash) and un-escaped & are the most common real-world errors
Submit and monitor the sitemap in Google Search Console for fetch status and errors
🔒Privacy & Security
Why Validating a Sitemap In-Browser Is a Privacy Win
Online sitemap validators either accept your uploaded file or crawl your sitemap URL from their server, exposing your URL structure — including staging, internal or not-yet-public paths — to a third party. The XML Sitemap Validator instead runs entirely on the user’s device: the pasted XML is parsed with the browser’s own DOMParser and checked with plain JavaScript, nothing is fetched, uploaded, logged or stored, and no site is crawled (there is deliberately no server proxy). That makes it safe to validate a STAGING or INTERNAL sitemap whose URLs you do not want to reveal before launch — a meaningful advantage when auditing a site that is not yet public. The tool works offline once cached as a PWA, and closing the tab discards everything entered. It adds no new dependency: all the parsing and rule-checking live in the small, reusable, well-typed engine sitemapValidateEngine.ts, and it ships built-in valid, index and invalid samples so you can see every check fire.
Sitemap XML is parsed locally and never uploaded — no server, no CDN, no crawl, no proxy
Safe for staging / internal sitemaps whose URL structure you don’t want to expose
Works offline once cached; closing the tab discards your data
No new dependency — the logic lives in the compact sitemapValidateEngine.ts
Dark mode and mobile support with a sticky Validate / Copy bar; valid / index / invalid samples
XML sitemap validation: in-browser (AnyTool) vs online validators
Capability
AnyTool
Typical online validators
Processing
Runs entirely in your browser
Uploads your file or crawls your URL server-side
Your sitemap
XML never uploaded, works offline
File uploaded or URL crawled by a server
Staging / internal sitemaps
Safe — URL structure never leaves the device
Exposed to a third-party service
Input
Paste your sitemap.xml contents
Often a URL the tool crawls
Type detection
<urlset> vs <sitemapindex>, with correct rules each
Notes Google ignores priority / changefreq; paste-source
Often implied authoritative
Cost / signup
Free, no signup
Often gated or ad-heavy
AnyTool validates a pasted sitemap locally against the sitemaps.org 0.9 protocol and Google’s documented rules and limits, and uploads nothing — safe for staging or internal sitemaps. It checks structure and format (root, namespace, loc / lastmod / changefreq / priority, entity-escaping, and the 50,000-URL / 50 MB limits); it does not crawl your site or confirm each URL returns HTTP 200, and Google now ignores priority and changefreq. Comparison as of July 2026.
