Skip to contentLockpick
How it worksPricingDocs

Read

  • BlogPlain answers to common security questions
  • GuidesStep by step fixes for common setups
  • Security checksEvery check we run, explained

Learn

  • Learn with PickTwo-minute lessons on how sites get attacked
  • Lockpick for ClaudeCheck sites from Claude and other assistants
  • GlossaryThe words we use, in plain words

Company

  • ChangelogWhat changed, newest first
  • StatusWhether scans are running right now
  • Security and trustHow we check and what we never do
Sign inCheck it
Checks

Are the last-updated dates in your sitemap believable?

By Mark KashefPublished October 8, 2026

This search visibility check flags last-updated dates in your sitemap that are invalid, in the future or all the same. Search engines learn to ignore dates that do not reflect real changes.

What does this check look at?

It looks at whether the last-updated dates in your sitemap are valid, in the past and different from each other. Google says it uses the date only when it is consistently and verifiably accurate. A Pulse also reads your sitemap, the list of pages you give search engines.

Pulse and Deep scans both run it.

Curious what your site shows from outside? The quick check is free and needs no account.

Check it

What does a result mean?

What the report showsWhat it meansWhat to do
Info findingThe dates look generated rather than real.Use each page’s real last change, or leave the date out.

It is about search visibility only and never affects your grade. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label. Sitemap cards are not security issues and never change your grade.

Fix it with your AI

The usual cause is a generator that stamps every page with the build time.

Fix prompt for any coding agent
My sitemap's lastmod dates are unreliable: [paste the problem from the report]. Change my sitemap generator so each page's lastmod comes from the real date its content last changed (for example a CMS updated date or the file's last commit date), in W3C date format, and leave lastmod out for pages where that date is unknown. Do not use the build time.

How to check

Say Atlas, our example app at atlas.example, stamps every sitemap entry with the time of the last deploy. All dates match, and the check adds one card.

Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.

Questions people ask

Is it better to leave dates out?

Leaving them out is better than wrong dates. Accurate dates help search engines revisit pages that really changed.

Does this change my security grade?

No. It is about search visibility only.

See what your site shows from outside

A quick check reads your homepage the way a visitor would and gives you a score. No account needed.

Check your site

Related pages

  • Does your sitemap list addresses search engines will skip?
  • Can search engines read your sitemap?
  • Does your site give search engines a sitemap?

Sources

  1. Build and submit a sitemap Google Search Central, read on October 7, 2026
  2. How we rate findings Lockpick docs, read on October 7, 2026
  3. Read your report Lockpick docs, read on October 7, 2026

About the author

Mark Kashef, Founder of Lockpick

I'm Mark, and I build Lockpick. I write these pages, and each one is checked against its sources before it goes live. The Updated date changes only when the page itself does.

Lockpick
PricingMethodologyDocsBlogGuidesSecurity checksLearn with PickSecurity and trustLockpick for ClaudeChangelogStatusFacts for AI assistants

Lockpick is a security scanner for vibe-coded apps. It checks what your live site exposes and what a GitHub repo or AI skill would do before you install it, then gives you a fix prompt for Lovable, Bolt, Replit, Cursor or Claude Code.

Lockpick assesses public pages you are authorized to test, and public GitHub code it never runs.

© 2026 LockpickTermsPrivacyContactSign in