Protecting sitemaps - Good idea or humbug?

[Roverandom]

Is there a way to protect your sitemap.xml so that only Google can read it and would it make sense to do this?

[TucsonAZWebDesign]

From a hacker's perspective, the first order of business is going to be gathering information on the target. does a hacker or someone with malicious intent gain something in obtaining access to your sitemap?

Yes, they do, and that is more information on the layout of your site. How common would there actually be something on the sitemap that could critically expose you to compromise on your VPS/Shared hosting? Um, probably super ultra rare.

But yes there was one time that I was doing an audit for a company and the sitemap did point to a directory that was vulnerable to directory browsing. Fishing around in the directory, I was able to obtain a picture of a PayPal MasterCard front and back because some idiot snapped pictures of it and uploaded it onto the site.

So there are benefits to hiding it, it's relatively easy to do, but if your lazy and don't want to, chances are your good.

[Roverandom]

Hi Herb,

Thank you for your feedback. I think you are right. We are dealing with very  short lived up-to-date information so it is vital that as few sites as possible have the information we have. For this reason I was considering to "hide" our sitemaps. Some of our competitors do that but probably we need to find some other measures to achieve our goal.

Cheers
Thomas

[Invite_Them_Home]

Hi Thomas;

You have not specified your web server platform, but assuming it is Apache it would be easy to do with a regular expression in your .htaccess

However, I do not see any valid reason for doing so.  Your sitemap should be a refection of your public menu and internal public links.  So other than making it easier for search and other spiders to crawl your site, it does not expose any information that is not available by other methods.  So, best practices say that you should have an accurate site map, and unless you have a reson for hiding it that you did not mention I would not hide it.

I will tell you those that you should not bother putting areas you do not want crawled in your robots.txt file and any of the bad folks will not respect the request.

Take care,

Herb