Managing Yoast SEO Sitemaps on Staging Sites

A staging site is a separate copy of a WordPress site where you review or test changes before publishing them on the public site. Its sitemap, a file that lists URLs for search engines to find, should reflect how you use the staging site. If the site is private, restrict access first. Yoast SEO settings control which URLs appear in the sitemap, but they do not stop visitors from viewing the site.

Choose settings based on whether the staging site is private, open to the public but excluded from search, or intentionally searchable. WordPress visibility settings and page-level noindex directives tell search engines not to index content. Password protection limits who can view the site. Check the live staging site to confirm that each control works.

Choose settings for the staging site’s purpose

For a private staging site, require a login at the hosting or server level. Then select Settings → Reading → Discourage search engines from indexing this site in WordPress. This setting asks search engines not to index the site. Visitors can still access it unless you restrict access separately. WordPress says the setting adds a noindex,nofollow directive when the theme includes the relevant output. Check the live pages instead of relying on the dashboard setting alone (WordPress Reading settings).

Yoast’s sitemap specification says that when WordPress marks the whole site private through its search-visibility setting, Yoast excludes all URLs from the sitemap. An empty sitemap index can therefore be expected. It still does not prove that the site is private: confirm that an unauthenticated visitor cannot view staging pages (Yoast’s sitemap specification).

For a public review site that should stay out of search, add a site-wide noindex signal and let search engines crawl the pages so they can read it. A noindex directive tells a crawler not to include a page in search results. Google explains that a crawler must access the page to see the directive, whether it appears in the page’s HTML or in an HTTP response header (Google’s noindex guidance). This reduces the chance of indexing, but it does not make the review site private.

If the staging site is intentionally searchable, configure Yoast to include only the content types and taxonomies that belong in search. A taxonomy is a way WordPress groups content, such as categories or tags. Review archive URLs as well as individual posts and pages, and avoid submitting the staging sitemap to search properties meant for production.

Control which URLs Yoast lists

In current Yoast SEO settings, find the XML sitemap feature under Yoast SEO → Settings → Site features → Technical SEO. Yoast also lets you choose whether individual content types and taxonomies appear in search. Turning off search visibility for a content type removes it from the sitemap. Setting an individual post or page to noindex removes that URL from the sitemap (Yoast’s sitemap settings). Menu labels can vary by plugin version, so check the names in your installed version.

Use those controls to shape sitemap output, not to enforce privacy. A page omitted from a sitemap can still be reached through a direct link, and a sitemap is only one way a crawler can discover a URL. Likewise, Yoast’s noindex header on its sitemap response applies to the sitemap file itself. It does not prevent search engines from indexing URLs listed inside that file.

Turning off Yoast’s sitemap feature does not necessarily remove every sitemap. Yoast says WordPress’s built-in sitemap can remain available when the Yoast feature is disabled. WordPress core has its own sitemap endpoint, and another plugin or a sitemap file stored on the host can provide one too (Yoast’s site feature documentation). Check the sitemap URLs on the staging host instead of assuming that one plugin setting stops all sitemap output.

Verify what the staging host serves

Check the live site after changing settings. A staging site copied from production can retain production URLs in canonical tags, which identify the preferred URL for a page, or in sitemap entries. Caches can also serve old output after a settings change. Yoast lists caching as one reason a sitemap might not update as expected (Yoast’s sitemap troubleshooting guidance).

Use a private browser session to test whether the home page and a representative content URL require authentication. For a publicly accessible staging site that should stay out of search, inspect a page’s HTML for a robots noindex meta tag or its HTTP response headers for X-Robots-Tag: noindex. Google also warns that robots.txt controls crawling rather than reliably preventing indexing: a blocked URL can still appear in results if Google learns about it elsewhere. Blocking a page from crawling can also stop Google from seeing its noindex directive (Google’s robots.txt guidance).

Then open the sitemap URLs directly. Check Yoast’s /sitemap_index.xml and WordPress core’s /wp-sitemap.xml directly. Another plugin or the host may add a sitemap URL, so check for those too. Note what each URL returns. It may serve sitemap XML or an empty index; the server may instead return a not-found response or restrict access. If a sitemap is available, inspect its child files and confirm that each listed URL uses the staging hostname and belongs on the staging site.

If Google has already indexed a staging URL, adding noindex does not remove it immediately. Google must recrawl the page, meaning visit it again, to see the directive. Google’s documentation does not promise a set time for another visit or removal from search results. When the property is available, use Search Console’s URL Inspection tool to check what Google received. An empty sitemap means it lists no URLs, and noindex tells search engines not to include a page in results. Test access restrictions separately to determine whether staging content is inaccessible.

What I'm building

Delegate tasks. Get software.

Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.

Take a look at vroni.com