XML sitemap
<loc>
The URL itself — the only required child of <url>, and the element where ampersands in query strings go wrong.
<loc> holds an absolute URL including the scheme, and it must be entity-escaped like any other XML text. That is the whole trap: a perfectly ordinary URL with two query parameters contains an ampersand, and an unescaped ampersand starts an entity reference. The file then fails to parse at all, which crawlers report as a broken sitemap rather than a broken URL.
The value is also length-limited — 2,048 characters — and must be under the same host and path prefix as the sitemap itself for a crawler to accept it.
- Format
- XML sitemap
- Namespace
- Sitemap protocol 0.9
- Parent
- <url>
- How many
- Exactly one per <url>.
Cardinality and constraints
Exactly one per <url>.
- Absolute URL with a scheme: https://example.com/page, never /page.
- Entity-escape the value. & becomes &, and that applies to every query string with more than one parameter.
- At most 2,048 characters.
- Must begin with the same host and path prefix as the sitemap that lists it.
What our validator does
Missing <loc> values are reported as an error, and repeated ones as a duplicate warning. An unescaped ampersand never reaches these checks — the document fails to parse first.
Broken and fixed
Both documents below are well-formed XML — that is the point of this corpus — and both are run through the validator on every test run. The verdicts here are what it returned, not what we expect it to.
<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url><loc>https://example.com/a</loc><lastmod>2026-08-10</lastmod></url>
<url><loc>https://example.com/a</loc><lastmod>2026-08-10</lastmod></url>
</urlset>1 duplicate URL(s) found.<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url><loc>https://example.com/a</loc><lastmod>2026-08-10</lastmod></url>
<url><loc>https://example.com/b</loc><lastmod>2026-08-10</lastmod></url>
</urlset>Where it reaches
- Parse errorsEntity is not definedWhat an unescaped & in a query string usually produces, before any sitemap check runs.
- ToolsXML escape & unescapeEscapes a URL so it survives inside <loc>.
- Datatypesxs:anyURIThe XSD type the sitemap schema declares for this value.
Related elements
- <url>One entry in a sitemap: a required <loc> plus the optional metadata a crawler may or may not use.
- <loc>The URL of a child sitemap. Same element name as in a sitemap, different meaning: it points at a file, not at a page.
- <lastmod>When the page last changed. The one piece of sitemap metadata search engines still act on — and only if you keep it honest.
Get started
Bring order to the XML your team can't afford to ignore.
Create a free account and get a private workspace to search, validate, diff, and monitor your XML feeds, sitemaps, schemas, and vendor integrations.