A manually built XML sitemap is a UTF-8 file containing a <urlset> element that lists one absolute page URL per <loc> element, optionally tagged with <lastmod>, <changefreq>, and <priority>, and is produced from a URL list rather than by crawling a site. Because every generated file is restricted to a single host (including any non-default port) and must respect the official sitemap protocol described on Google Search Central, the practical path to a standards-based file is to start from a reviewed list of absolute HTTP or HTTPS URLs, decide whether one shared optional value is honest, and let a browser-side list-to-XML utility handle the serialization, escaping, and XML assembly for you. The result is a sitemap.xml file you can host on the represented site and submit through the usual channels without exposing the URL list or the generated XML to a remote service.
The "manual" framing matters here. Plugin-based sitemaps and crawler-based generators operate without a URL list — they discover pages and emit XML on your behalf. Manual creation reverses that flow: you supply the URLs because you already know which pages belong in the sitemap, and you want the file to match that judgment exactly. A list-to-XML tool is the natural fit, since every other decision (host filtering, protocol rule compliance, dedup, character escaping) follows directly from the list you paste.
Why a list-to-XML approach is the right shape for manual creation
Crawler-based generators are useful when you do not know what is on the site. The opposite problem — knowing exactly which URLs belong in the sitemap — is what manual creation addresses. For static sites, hand-curated landing pages, microsites under construction, or post-migration cleanup, a reviewed list of absolute URLs is faster and more accurate than letting a crawler discover them, because crawlers also pick up redirects, blocked pages, staging URLs, paginated variants, and admin paths you do not want indexed.
The XML Sitemap Generator is built around this list-to-XML shape. You paste URLs into the editor, optionally apply one shared lastmod, changefreq, or priority, generate, review, and download sitemap.xml. Nothing is uploaded — every parse, normalization, escape, and write happens in the current browser tab, so the URL list never leaves your machine. That makes it appropriate when the sitemap author is also the curator of the URL list, which is the manual-creation scenario.
Sitemap protocol rules to respect before you paste
The sitemap protocol imposes a few hard constraints on the file. Each <loc> must be an absolute URL with fewer than 2,048 characters. Each generated file is limited to one host (matching the protocol's single-host rule), and a non-default port counts as part of the host, so mixing example.com and example.com:8443 fails. HTTP and HTTPS URLs for the same host are accepted in the same file because the protocol compares hosts, not origins, but different hosts or different non-default ports require separate sitemap files.
The protocol also caps each file at 50,000 URLs and 52,428,800 uncompressed bytes. The XML Sitemap Generator uses lower whole-file budgets — 10,000 unique URLs and 10,485,760 UTF-8 bytes — so it can bound preview and Blob memory in the browser. These caps fail the whole generation rather than truncating silently, which means an over-limit list tells you exactly what to split before you paste. Cross-site submission permissions are not checked: the generator cannot tell whether the sitemap will live on the host its URLs describe, so plan hosting before you publish.
Input hygiene also matters. Bare domains, relative paths, FTP URLs, raw control characters, malformed percent escapes, embedded credentials, and fragments are all rejected rather than silently fixed. Whitespace-only lines are ignored, but a stray leading or trailing space on a nonblank line is an error. Invalid lines fail the generation — they are never skipped, and excess valid URLs are never silently dropped, so the preview always matches the final file.
How to create sitemap.xml from a URL list
- Compile a reviewed list of absolute HTTP or HTTPS page URLs, one per line, with no leading or trailing whitespace on any nonblank line. Whitespace-only lines are ignored, but a stray space before or after a URL is an error.
- Confirm the list contains only one serialized host, including any non-default port. Strip bare domains, relative paths, FTP URLs, embedded credentials, fragments, raw control characters, and malformed percent escapes — the generator rejects all of these rather than fixing them silently.
- Open the XML Sitemap Generator and paste the list into the URL field.
- Leave the optional lastmod, changefreq, and priority fields blank if you only want loc entries, or fill in a single shared value when that value is truthful for every URL on the list. Optional fields apply to all entries; there is no per-URL override.
- Click Generate and read the result. The tool displays the complete XML, the count of unique URLs, the count of duplicates ignored, and any line-level validation errors. Invalid lines fail the generation rather than being skipped.
- Download sitemap.xml, then host it on the represented site and submit it through your preferred channel.
Optional metadata: when shared lastmod, changefreq, and priority are honest
Optional tags only help when the value is true. lastmod should reflect the page's actual significant modification — not a regeneration timestamp and not a recent date chosen to look active. Because the generator applies the same value to every URL, lastmod is honest only when a single date applies to every entry on the list, which rarely happens for an arbitrary site. Leave it blank when entries have different real modification dates.
changefreq accepts seven protocol-defined tokens and priority accepts a decimal from 0.0 through 1.0. Both are hints, not crawl commands or ranking guarantees, and search engines interpret them flexibly. Treat them as documentation rather than directives.
| Tag | Required | Format | When to include |
|---|---|---|---|
| loc | Yes | Absolute HTTP or HTTPS URL, < 2,048 chars | Every entry, always |
| lastmod | No | YYYY-MM-DD or full date-time with timezone | Only when one real shared date applies to all entries |
| changefreq | No | One of seven tokens | Only when one shared update cadence is true |
| priority | No | Decimal 0.0 to 1.0 | Only as a hint of relative importance across the list |
| changefreq value | Meaning per protocol |
|---|---|
| always | Page changes on every access |
| hourly | Page changes roughly every hour |
| daily | Page changes roughly every day |
| weekly | Page changes roughly every week |
| monthly | Page changes roughly every month |
| yearly | Page changes roughly every year |
| never | Page is archived |
Invalid optional metadata fails the whole generation rather than being silently trimmed, so an empty lastmod field with whitespace, an unsupported changefreq token, or a priority outside 0.0 to 1.0 will block the download. This forces honesty: if the metadata is not truthful for every entry, it should not be in the file at all.
Reading the generated XML before you download
The XML output begins with a UTF-8 declaration and a <urlset> element using the official namespace http://www.sitemaps.org/schemas/sitemap/0.9. Each entry contains a <url> with a <loc>, and the optional tags you supplied appear in every entry. Locations are XML-escaped after URL normalization, and the generator escapes the five XML entities in this order: ampersand first, then apostrophe, quotation mark, greater-than sign, and less-than sign. Replacing ampersand first means an entity like ' is not re-escaped a second time.
Concrete worked example for the escaping order: start with the raw URL https://example.com/products?id=12&cat=O'Brien. Step 1, escape ampersand first: https://example.com/products?id=12&cat=O'Brien. Step 2, escape the apostrophe: https://example.com/products?id=12&cat=O'Brien. That is the exact serialization that should appear inside the <loc> element in the preview before downloading. The tool also reports the unique URL count and the duplicate count, so you can confirm the single-host rule is intact.
Deduplication happens after URL serialization, and the first occurrence determines output order. An uppercase host and its lowercase form identify the same URL, as do an explicit default port and its normalized form. Editing URLs or any option immediately revokes the prior download and clears old XML, so the preview and the downloaded file always match the current inputs.
What happens after you download sitemap.xml
Manual creation ends with a file, but publication is a separate step. Host sitemap.xml on the host its URLs describe, ideally at the root so the path resolves to https://example.com/sitemap.xml. Reference the file in robots.txt with a Sitemap: line, then submit the URL through Google Search Console or the equivalent surface for other engines. The submission step is outside any list-to-XML utility — the generator produces the file, hosting and submission are yours.
Before publication, audit the URL list once more for redirects, duplicate content, blocked pages, and private paths. The file is only as accurate as the list and optional metadata you supplied. Reviewing the previewed XML and counts is the last automated check; the editorial review is yours.