Skip to content

README.md

Latest commit

 

History

History
73 lines (58 loc) · 3.03 KB

README.md

File metadata and controls

73 lines (58 loc) · 3.03 KB
Raw

audit-sitemap

SEO deploy gate — recursively audit a sitemap (or sitemap-index) so sitemap rot is caught in CI, not as a slow crawl-budget bleed in Search Console.

What it catches

Sitemap-level:

  • Malformed XML (SITEMAP_MALFORMED) and XXE payloads (SITEMAP_XXE) — see hardening note below.
  • Over the protocol limits: > 50,000 URLs (SITEMAP_TOO_MANY_URLS) or

    50 MB uncompressed (SITEMAP_TOO_LARGE).

  • Lying <lastmod>: not a valid W3C datetime (SITEMAP_LASTMOD_INVALID), or every URL sharing one deploy timestamp (SITEMAP_DEPLOY_TIMESTAMP).
  • Wrong Content-Type in URL mode (SITEMAP_CONTENT_TYPE).

Per sampled URL:

  • 404 / non-200 (SITEMAP_URL_STATUS).
  • Redirects — a sitemap should list final URLs (SITEMAP_URL_REDIRECT / SITEMAP_URL_REDIRECTS, governed by max-redirect-hops).
  • Blocked by robots.txt (SITEMAP_ROBOTS_BLOCKED).
  • noindex via meta or X-Robots-Tag header (SITEMAP_NOINDEX).
  • Canonical points elsewhere (SITEMAP_CANONICAL_MISMATCH).
  • Staging / foreign host leak (SITEMAP_STAGING_HOST / SITEMAP_FOREIGN_HOST) — flagged without fetching the URL.

Correctness notes

  • Hardened XML parsing. The parser refuses any document containing a DOCTYPE or ENTITY declaration and disables entity processing, closing the XXE/SSRF (billion-laughs, file://) vectors. Gzipped sitemaps (.xml.gz or Content-Encoding: gzip) are transparently decompressed, then the 50 MB limit is checked against the uncompressed size.
  • Gzip bomb safety. The uncompressed-size limit guards against decompression blowups; sampled URLs on a foreign/staging host are never fetched.

Usage

- uses: nimajafari/seo-ci/actions/audit-sitemap@v1
  with:
    sitemap: https://www.example.com/sitemap.xml
    sample: 100            # URLs to check per sitemap (0 = all)
    canonical-form: any    # trailing_slash | no_trailing_slash | any
    max-redirect-hops: 0   # sitemap URLs must be terminal 200s
    user-agent: Googlebot

Inputs

Input Default Description
sitemap — (required) Sitemap file path or URL.
sample 50 URLs sampled per sitemap (0 = all).
canonical-form any Trailing-slash policy for canonical matching.
max-redirect-hops 0 Allowed redirect hops for a sampled URL.
user-agent Googlebot Agent for fetching + robots evaluation.
robots "" robots.txt path for file-mode robots checks (URL mode auto-fetches).
strict false Treat warnings as errors.
report-path "" Write the JSON report to this path.

Outputs

passed, errors, warnings, notices, report — see the top-level README.

Caveat: A starting point, not a drop-in guarantee. The canonical form, indexable set, and what counts as a "staging" host are specific to your site — tune canonical-form and sample, and review SITEMAP_FOREIGN_HOST findings against your real multi-host setup.