ForHosting KIT · SEO

Validate a sitemap

A sitemap is the one file that's supposed to be a trustworthy inventory of a site, and yet most of them accumulate dead URLs, stale timestamps, and formatting errors that quietly erode how much a crawler trusts the rest of the file. This endpoint parses the XML, tests every listed URL, and reports exactly what's wrong and where.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Why trust in the file matters

A sitemap doesn't force a search engine to crawl anything; it's a submission, and crawlers weigh how reliable that submission has historically been. A file where a meaningful share of URLs return 404s, redirect elsewhere, or point to non-canonical pages teaches a crawler to treat the whole file with more skepticism, which can slow discovery of the legitimate new URLs sitting right alongside the broken ones.

What gets validated

The task starts with structural validation against the sitemap protocol — well-formed XML, correct namespace declarations, and the 50,000 URL / 50MB uncompressed size limits the format has carried since it was introduced in 2005 — then moves to per-URL checks: each listed location is fetched and its status recorded, so 404s, 5xx errors, and unexpected redirect chains all surface individually rather than as one opaque failure count. It also checks the lastmod field for a properly formatted date that isn't suspiciously identical across thousands of unrelated URLs, a common sign of an auto-generated field nobody actually maintains.

The hreflang connection

Sitemaps can carry hreflang annotations as an alternative to putting them in the HTML head, and when they do, the same reciprocity rule applies: every alternate listed for a URL needs a matching return annotation on the corresponding entry. This endpoint checks for that directly within the sitemap's own xhtml:link entries, catching a missing or one-directional hreflang declaration without needing a separate crawl of the pages themselves.

A format built for a different era

The sitemap protocol was designed when sites were smaller and updates were infrequent enough that a hand-maintained file made sense; today's sitemaps are almost universally auto-generated, and the errors that creep in are correspondingly systemic rather than one-off typos — a template bug affects every URL of a given type at once, which is exactly the kind of pattern-level issue a full validation pass is built to surface quickly.

Keeping it clean over time

Because sitemaps regenerate on every content change for most sites, validating them once and assuming they stay correct is a losing strategy; the practical approach is to submit the sitemap URL after each deploy or on a recurring schedule, receive a task_id immediately, and get the full per-URL and per-field report on your webhook once the crawl completes. At $0.002 per request, checking a large sitemap regularly costs far less than losing crawl budget to a file full of dead links.

What you can do with it

Post-deploy sitemap health check

Validate the regenerated sitemap right after a release to catch a template bug that's suddenly listing draft or deleted pages.

Broken URL sweep

Run a full sitemap through the validator quarterly to prune accumulated 404s and redirects before they erode crawler trust in the file.

Lastmod accuracy audit

Spot-check whether lastmod dates genuinely reflect content changes or are simply stamped with the current date on every regeneration.

Multilingual sitemap hreflang check

Confirm that hreflang alternates declared inside the sitemap are fully reciprocal across every language entry, not just outbound.

FAQ

What does the sitemap validator API check?

It validates the XML structure and size limits against the sitemap protocol, tests every listed URL's HTTP status, checks lastmod formatting, and verifies any hreflang annotations included in the sitemap are reciprocal.

Will it catch broken links inside the sitemap?

Yes, each URL is fetched and its response status recorded, so 404s, server errors, and unexpected redirect chains are reported individually.

Does it check hreflang in sitemaps as well as HTML?

Yes, this endpoint checks hreflang declared through xhtml:link entries directly in the sitemap and confirms reciprocity between paired URLs.

Is there a limit on sitemap size it can validate?

It validates against the same limits the sitemap protocol itself enforces, 50,000 URLs and 50MB uncompressed per file, and flags a sitemap that exceeds them.

How much does one validation cost?

$0.002 per request, charged only when the crawl completes successfully; failures retry up to three times before returning an error at no charge.

Is there a free tier?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

How do I get the validation report?

By signed webhook, recommended for automated pipelines, or a signed link valid for 24 hours.

Can I validate a sitemap index that references multiple child sitemaps?

Yes, submit the index URL and each referenced sitemap is fetched and validated in turn.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/seo/sitemap-validate

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/seo/sitemap-validate \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"input":"…"}'

const res = await fetch("https://api.kit.forhosting.com/seo/sitemap-validate", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "input": "…"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/seo/sitemap-validate",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "input": "…"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/seo/sitemap-validate", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"input":"…"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"input":"…"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/seo/sitemap-validate", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "input": "…"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "seo.sitemap_validate",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free