XML sitemaps in Joomla: what core lacks and what belongs in the file

Search for "Joomla sitemap" in the backend and you will find nothing. Joomla 4, 5 and 6 ship without an XML sitemap generator. That surprises people who come from other systems, and it leads to two common mistakes: a site that never gets a sitemap at all, or one with an extension that dumps every URL it can find into the file, including the ones you would rather Google forgot.

This article covers what a sitemap does and does not do, how to add one to a Joomla site, and what belongs in it.

What a sitemap actually does

An XML sitemap is a list of URLs you would like search engines to know about. It is a hint, not an instruction. Google still decides what to crawl and what to index, and a page in the sitemap that is thin, duplicated or blocked will not rank because it is listed.

Where a sitemap helps is discovery. A new article that is only linked from page four of a category blog can take weeks to be found by following links. In the sitemap, with a correct modification date, it is usually picked up within days. Large sites, new sites and sites with deep category structures benefit most. A twenty-page brochure site with a clean menu gets little out of it, though it does no harm.

A few facts that save time:

• Google ignores the <priority> and <changefreq> fields. Do not spend an afternoon tuning them.
• Google does use <lastmod>, but only when it is reliable. A sitemap that reports every page as changed today teaches Google to ignore the date.
• One sitemap file holds at most 50,000 URLs or 50 MB uncompressed. Above that you need a sitemap index that points to several files. Good extensions split automatically.

Getting a sitemap on a Joomla site

Because core has no generator, you have three options.

1. A sitemap extension

This is the route for most sites. Extensions such as OSMap and JSitemap read your menus and components and output an XML file at a fixed address. Most can also produce an HTML sitemap for visitors, an image sitemap and a news sitemap. Check three things before you pick one:

• It supports the components you actually use, such as articles, contacts, tags or a shop. Each component needs its own plugin inside the sitemap extension.
• It fills <lastmod> from the real modification date of the article, not from the moment the sitemap was generated.
• It generates URLs through Joomla's router, so the addresses in the sitemap match the ones on your pages exactly, with the same trailing slash, language prefix and suffix settings.

2. An SEO suite

Several commercial SEO extensions include a sitemap module next to metadata and redirect tools. Worth it if you already need the rest of the package. Avoid running two sitemap generators side by side; they will not agree.

3. An external crawler

Tools like Screaming Frog can crawl the site and write a sitemap file that you upload. It works, but the file is out of date the moment you publish a new article. Only use this for a site that hardly changes.

How OSMap-style generators build the list

Most Joomla sitemap extensions start from your menus. Each menu item becomes a URL, and for a category blog or list item the extension adds the articles inside that category. That has one consequence people miss: an article that is not reachable through any menu item, directly or via its category, often does not appear in the sitemap at all.

The usual fix is a hidden menu: a menu that is not assigned to any module, with category items for the sections you want covered. The pages get clean URLs, the sitemap picks them up, and visitors do not see an extra menu. The same hidden menu is what makes Joomla's router produce tidy addresses, which we covered in One article, six addresses.

What does not belong in the sitemap

A sitemap should list the canonical version of every page you want in search results, and nothing else. Leave out:

• Pages set to noindex. Listing a page and telling Google not to index it sends mixed signals. Check the Robots field on menu items and articles.
• URLs that redirect. If the Redirect component or a .htaccess rule sends an address elsewhere, list the destination only.
• Duplicates. The same article under a second menu item, the index.php?option=com_content&view=article&id=.. form, or a version with ?start= pagination.
• Utility pages. Login, registration, password reset, search results and the user profile. Exclude their menu items in the extension's settings.
• Tag and archive pages, unless you have made them into real landing pages with their own text.
• Anything blocked in robots.txt. Google cannot crawl it, so it cannot check it. See Robots.txt in Joomla for what to block.

Multilingual sites

On a site with the Language Filter plugin, each language version needs its own URL in the sitemap, with its language prefix. You can tell Google which pages are translations of each other in two ways: hreflang links in the page head, or xhtml:link entries in the sitemap. Joomla's Language Filter plugin already does the first when Add Alternate Meta Tags is set to Yes and the items are linked as associations. That is enough for most sites. Doing both is allowed, but they must say the same thing.

Telling search engines where it is

A sitemap nobody knows about is not used. Do two things after it goes live:

1. Add a line to robots.txt with the full address, for example Sitemap: https://example.com/index.php?option=com_osmap&view=xml&id=1 or the shorter URL your extension offers. The line can go anywhere in the file and must use an absolute URL.
2. Submit the same address in Google Search Console under Sitemaps, and in Bing Webmaster Tools. Search Console then shows how many listed URLs it found and how many it indexed.

That second report is the useful part. A large gap between submitted and indexed pages points to thin content, duplicates or pages Google considers unimportant. Open the Pages report, filter on the sitemap, and look at the reasons it gives.

A quick check

Open the sitemap URL in a browser once a month and look at it. Does it load without errors? Are the newest articles there with today's or yesterday's date? Do the URLs match the ones in your address bar, including https and the right domain? Is there anything in it you would not want a stranger to find through Google? Five minutes, and you catch the problems before Search Console mails you about them.