# Does your robots.txt point search engines to your sitemap?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

This search visibility check flags a sitemap that robots.txt does not name. One line fixes it, and it never affects your security grade.

This search visibility check flags a sitemap that exists but is not named in your robots.txt file. Search engines that only read robots.txt may never find it.

## What does this check look at?

It looks at whether your robots.txt file names the sitemap your site has. Google says a Sitemap line anywhere in robots.txt is enough for it to find your sitemap the next time it crawls that file. A Pulse also reads your sitemap, the list of pages you give search engines.

Pulse and Deep scans both run it.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Info finding | A sitemap exists, and robots.txt does not name it. | Add a Sitemap line with its full address. |

It is about search visibility only and never affects your grade. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label. Sitemap cards are not security issues and never change your grade.

## Which standards does it relate to?

None. It is about search visibility, so no security standard applies, and it never moves your grade.

## Fix it with your AI

It is one line, with the full https address of the sitemap.

:::fix-prompt any
Add a Sitemap line to my robots.txt that gives the full https address of my sitemap (or sitemap index). If my framework generates robots.txt, change the generator rather than a static file. Show me the final robots.txt.
:::

## How to check

Say Atlas, our example app at `atlas.example`, serves a sitemap at the usual address but its robots.txt never mentions it. The check adds one information card.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Is submitting the sitemap in Search Console enough?

For Google, yes. Naming it in robots.txt also helps every other search engine and crawler find it.

### Can robots.txt name more than one sitemap?

Yes. Add one Sitemap line for each sitemap or sitemap index.

## Sources

- [Build and submit a sitemap](https://developers.google.com/search/docs/crawling-indexing/sitemaps/build-sitemap), Google Search Central, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [Read your report](https://www.lockpick.app/docs/get-started/read-your-report), Lockpick docs, read on 2026-10-07