An XML sitemap can be published at almost any public URL. /sitemap.xml is common, not mandatory.
That is why sitemap discovery should begin with declared evidence and use common paths only as a bounded fallback.
Start with robots.txt
Request the site’s root /robots.txt file and look for lines beginning with Sitemap:. A declaration should contain a complete public sitemap URL.
User-agent: *
Allow: /
Sitemap: https://example.com/sitemap.xmlGoogle documents robots.txt declarations as one way to make a sitemap available, alongside Search Console submission. A file may contain more than one declaration. See Google’s sitemap submission guidance.
Check a short list of common locations
When robots.txt contains no declaration, a few conventional paths are reasonable to inspect:
/sitemap.xml/sitemap_index.xml/sitemap-index.xml
Do not turn this into unlimited path probing. Failing to find a file at these locations does not prove that no sitemap exists.
Verify the response, not the filename
A URL ending in .xml can return a branded HTML error page with HTTP 200. A useful discovery result should record:
- The entered website URL.
- The location checked.
- Whether it came from robots.txt or a common-path fallback.
- Redirects and final URL.
- Final HTTP status and content type.
- Whether the response contains a sitemap root such as
<urlset>or<sitemapindex>.
This evidence separates a real XML resource from a soft 404 or an unrelated response.
Finding is not validating
Discovery answers where a sitemap is publicly available. It does not establish that the XML is well formed, that every location is canonical, or that search engines have accepted the file.
Use a separate validator for those questions. Then use Search Console on a verified property when you need Google’s private submission and processing evidence.
A sitemap is a hint, not an indexing result
Google describes sitemap submission as a hint. A discovered or submitted sitemap does not guarantee that it will be fetched or that its URLs will be crawled, indexed, ranked, or displayed.
Small, well-linked sites may not need a sitemap. Larger, newer, media-heavy, or frequently changing sites often benefit more from one. See Google’s sitemap overview.
A safe discovery workflow
- Normalize the website to its public origin.
- Fetch root robots.txt through guarded public-only networking.
- Record every valid Sitemap declaration.
- Check those declarations first.
- Check only a bounded fallback list when useful.
- Confirm final response and XML evidence.
- Validate the discovered file separately.
- Record the limits of the discovery method.
Use the free Sitemap Finder to inspect declared and common locations with visible response evidence.
Method note: the tool checks root robots.txt and three bounded common locations. It does not brute-force paths or inspect private Search Console data. Last reviewed 30 August 2026.
