Mistake: generating the sitemap from inside an auth wall

Mistake: generating the sitemap from inside an auth wall

A sitemap built from your logged-in admin view can include staging URLs, draft previews, or member-only pages that 401/403 for Googlebot. The crawler sees errors you never see.

Fix checklist:
— ✅ Generator queries the same visibility rules a logged-out crawler experiences — public, published, indexable only
— ✅ No staging/preview hostnames, no ?preview= tokens, no admin paths in <loc>
— Fetch a sample of sitemap URLs as an anonymous client (no cookies) and confirm 200, not 401/403/302-to-login
— Block staging environments from emitting a public sitemap at all

Definition of done: with a cookie-free client, request 15 random sitemap URLs. All must return 200 public content. Any login redirect or 403 means the generator is running with privileges Googlebot does not have.