# Does your sitemap list addresses search engines will skip?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

This search visibility check flags sitemap entries that are insecure, duplicated, relative or on another site. It never affects your security grade.

This search visibility check flags sitemap entries search engines are likely to skip, such as http addresses on an https site, the www twin of your address, duplicates, relative paths or other sites.

## What does this check look at?

It looks at whether your sitemap lists insecure, duplicate, relative or other-site addresses. Google asks for fully-qualified, absolute URLs in sitemaps. Listed pages are never requested. A Pulse also reads your sitemap, the list of pages you give search engines.

Pulse and Deep scans both run it.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Info finding | Some entries are unusable as listed. | List each page once, with its exact https address. |

Listed pages are not requested, and it is about search visibility only. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label. Sitemap cards are not security issues and never change your grade.

## Which standards does it relate to?

None. It is about search visibility, so no security standard applies, and it never moves your grade.

## Fix it with your AI

Point the generator at your canonical address and let it build every entry from that.

:::fix-prompt any
My sitemap has entries search engines will skip: [paste the problem from the report]. Fix my sitemap generator so every entry is an absolute https address on my canonical host (the same www or non-www form my site redirects to), each page is listed once, and no other site's pages are included. Show me a sample of the new entries.
:::

## How to check

Say Atlas, our example app at `atlas.example`, builds its sitemap from an old base address that still uses http. Every entry points at the insecure twin, and the check adds one card.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Why does the www twin matter?

Search engines treat the www and bare forms as different addresses. Listing the one your site redirects away from wastes the entry.

### Does this affect my Lockpick grade?

No. It is a search visibility card only.

## Sources

- [Build and submit a sitemap](https://developers.google.com/search/docs/crawling-indexing/sitemaps/build-sitemap), Google Search Central, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [Read your report](https://www.lockpick.app/docs/get-started/read-your-report), Lockpick docs, read on 2026-10-07