Changeset 63573

Timestamp:

09/10/2026 12:38:33 AM (8 hours ago)

Author:

westonruter

Message:

Sitemaps: Don't 404 valid sitemaps on sites with no posts.

WP::handle_404() sets a 404 when the main query matches no posts and no exception applies. Sitemap requests were never among those exceptions; they were shielded only incidentally, by falling through to is_home, and in r62664 that fallthrough was removed. A site with no published posts therefore served a complete, valid sitemap under a 404 status, which search engines discard.

Exempt sitemap and stylesheet routes there, alongside the existing admin, robots and favicon exceptions. Since handle_404() no longer decides the status for these requests, every sitemap 404 now has to be issued by WP_Sitemaps::render_sitemaps() instead: an unregistered provider, an unrecognized stylesheet type, and a route whose query vars do not survive sanitize_text_field() would each otherwise be served as a 200 on an arbitrary URL. These share a send_404() helper, which also sends the no-cache headers handle_404() was previously contributing, so an intermediary does not retain a 404 for a route that becomes valid once the site has more content.

Sitemaps disabled via the wp_sitemaps_enabled filter, and providers with an empty URL list, keep the status they already had; whether the latter should render an empty sitemap instead is #61293.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13247.
Follow-up to r48072, r48523, r62664.

Reviewed by adamsilverstein.
Merges r63570 to the 7.0 branch.

Props iamchitti, westonruter, fernandot, wildworks, harishtewari, l1onofjudah, luksusspokoju, abrahamfariaz, andreasca, siliconforks, adamsilverstein, audrasjb, ocean90, mrkenobi.
See #39157, #61293.
Fixes #65945.

Location:

branches/7.0

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp.php (modified) (1 diff)
• src/wp-includes/sitemaps/class-wp-sitemaps.php (modified) (6 diffs)
• tests/phpunit/tests/sitemaps/sitemaps.php (modified) (1 diff)
• tests/phpunit/tests/wp/handle404.php (copied) (copied from trunk/tests/phpunit/tests/wp/handle404.php )

branches/7.0/src/wp-includes/class-wp.php

@@ -747 +747 @@
                 $set_404 = true;
 
-                // Never 404 for the admin, robots, or favicon.
-                if ( is_admin() || is_robots() || is_favicon() ) {
+                // Never 404 here for the admin, robots, favicon, or sitemaps.
+                // Sitemap routes send their own status in WP_Sitemaps::render_sitemaps().
+                if ( is_admin() || is_robots() || is_favicon() || is_sitemap() || get_query_var( 'sitemap-stylesheet' ) ) {
                         $set_404 = false;
 

branches/7.0/src/wp-includes/sitemaps/class-wp-sitemaps.php

@@ -158 +158 @@
          *
          * @since 5.5.0
-         *
-         * @global WP_Query $wp_query WordPress Query object.
          */
         public function render_sitemaps() {
-                global $wp_query;
+                /*
+                 * Bail early if this isn't a sitemap or stylesheet route.
+                 *
+                 * This runs on every front-end request, so it comes before any
+                 * sanitizing. The raw query vars are tested here, matching
+                 * WP::handle_404(), which exempts sitemap requests from its own 404 on
+                 * the same basis. Testing the sanitized values instead would let a
+                 * request that handle_404() exempted fall through both, leaving it a 200.
+                 */
+                if ( ! get_query_var( 'sitemap' ) && ! get_query_var( 'sitemap-stylesheet' ) ) {
+                        return;
+                }
 
                 $sitemap         = sanitize_text_field( get_query_var( 'sitemap' ) );
@@ -169 +178 @@
                 $paged           = absint( get_query_var( 'paged' ) );
 
-                // Bail early if this isn't a sitemap or stylesheet route.
+                // Force a 404 and bail early if the route did not survive sanitizing.
                 if ( ! ( $sitemap || $stylesheet_type ) ) {
+                        $this->send_404();
                         return;
                 }
 
                 if ( ! $this->sitemaps_enabled() ) {
-                        $wp_query->set_404();
-                        status_header( 404 );
+                        $this->send_404();
                         return;
                 }
@@ -182 +191 @@
                 // Render stylesheet if this is stylesheet route.
                 if ( $stylesheet_type ) {
+                        // Force a 404 and bail early if the stylesheet type is not recognized.
+                        if ( ! in_array( $stylesheet_type, array( 'sitemap', 'index' ), true ) ) {
+                                $this->send_404();
+                                return;
+                        }
+
                         $stylesheet = new WP_Sitemaps_Stylesheet();
 
@@ -198 +213 @@
                 $provider = $this->registry->get_provider( $sitemap );
 
+                // Force a 404 and bail early if the requested provider is not registered.
                 if ( ! $provider ) {
+                        $this->send_404();
                         return;
                 }
@@ -210 +227 @@
                 // Force a 404 and bail early if no URLs are present.
                 if ( empty( $url_list ) ) {
-                        $wp_query->set_404();
-                        status_header( 404 );
+                        $this->send_404();
                         return;
                 }
@@ -217 +233 @@
                 $this->renderer->render_sitemap( $url_list );
                 exit;
+        }
+
+        /**
+         * Sends a 404 for a sitemap route that cannot be served.
+         *
+         * WP::handle_404() exempts sitemap requests, so every sitemap 404 is issued
+         * here instead. That includes the no-cache headers handle_404() sends with
+         * its own 404, so an intermediary does not retain a 404 for a route that
+         * becomes valid once the site has more content.
+         *
+         * @since 7.1.1
+         *
+         * @global WP_Query $wp_query WordPress Query object.
+         */
+        private function send_404(): void {
+                global $wp_query;
+
+                $wp_query->set_404();
+                status_header( 404 );
+                nocache_headers();
         }
 

branches/7.0/tests/phpunit/tests/sitemaps/sitemaps.php

@@ -494 +494 @@
                 $this->assertTrue( is_404() );
         }
+
+        /**
+         * Ensures a paged subtype route with no URLs still 404s, now that
+         * WP::handle_404() no longer sets a 404 for sitemap requests.
+         *
+         * @ticket 65945
+         */
+        public function test_empty_url_list_for_subtype_should_return_404() {
+                wp_register_sitemap_provider( 'foo', new WP_Sitemaps_Empty_Test_Provider( 'foo' ) );
+
+                $this->go_to( home_url( '/?sitemap=foo&sitemap-subtype=bar&paged=2' ) );
+
+                wp_sitemaps_get_server()->render_sitemaps();
+
+                $this->assertTrue( is_404() );
+        }
+
+        /**
+         * Ensures a sitemap query var that does not survive sanitizing 404s.
+         *
+         * WP::handle_404() exempts these requests on the raw query var, while
+         * render_sitemaps() acts on the sanitized value. Without a matching bail
+         * they fall through both and an arbitrary URL is served as a 200.
+         *
+         * @ticket 65945
+         *
+         * @dataProvider data_unusable_sitemap_query_vars
+         *
+         * @param non-falsy-string $query_string Query string to append to a nonexistent URL.
+         */
+        public function test_unusable_sitemap_query_var_should_return_404( string $query_string ) {
+                $this->set_permalink_structure( '/%postname%/' );
+
+                // Instantiate the server before navigating: registering the sitemap
+                // rewrite tags is what adds the query vars to `$wp->public_query_vars`.
+                $sitemaps = wp_sitemaps_get_server();
+
+                $this->go_to( home_url( '/this-page-does-not-exist/' . $query_string ) );
+
+                $this->assertFalse( is_404(), 'WP::handle_404() should not have set a 404.' );
+
+                $sitemaps->render_sitemaps();
+
+                $this->assertTrue( is_404(), 'render_sitemaps() should have set a 404.' );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array<non-falsy-string, array{ non-falsy-string }>
+         */
+        public function data_unusable_sitemap_query_vars(): array {
+                return array(
+                        'value stripped by sanitizing' => array( '?sitemap=<>' ),
+                        'array sitemap value'          => array( '?sitemap[]=index' ),
+                        'array stylesheet value'       => array( '?sitemap-stylesheet[]=sitemap' ),
+                );
+        }
+
+        /**
+         * Ensures an unrecognized stylesheet type 404s from render_sitemaps().
+         *
+         * WP::handle_404() exempts any request carrying a `sitemap-stylesheet`
+         * query var, and WP_Sitemaps_Stylesheet::render_stylesheet() echoes nothing
+         * for a type other than 'sitemap' or 'index', so this route would otherwise
+         * be served as a 200 with an empty body.
+         *
+         * @ticket 65945
+         */
+        public function test_unrecognized_stylesheet_type_should_return_404() {
+                // Instantiate the server before navigating: registering the sitemap rewrite
+                // tags is what adds `sitemap-stylesheet` to `$wp->public_query_vars`.
+                $sitemaps = wp_sitemaps_get_server();
+
+                $this->go_to( home_url( '/?sitemap-stylesheet=this-is-not-a-stylesheet' ) );
+
+                $this->assertFalse( is_404(), 'WP::handle_404() should not have set a 404.' );
+
+                $sitemaps->render_sitemaps();
+
+                $this->assertTrue( is_404(), 'render_sitemaps() should have set a 404.' );
+        }
+
+        /**
+         * Ensures an unregistered provider 404s from render_sitemaps().
+         *
+         * WP::handle_404() exempts every sitemap request, so this route would
+         * otherwise be served with a 200.
+         *
+         * @ticket 65945
+         */
+        public function test_unregistered_provider_should_return_404() {
+                // Instantiate the server before navigating: registering the sitemap
+                // rewrite tags is what adds `sitemap` to `$wp->public_query_vars`.
+                $sitemaps = wp_sitemaps_get_server();
+
+                $this->go_to( home_url( '/?sitemap=this-provider-does-not-exist' ) );
+
+                $this->assertFalse( is_404(), 'WP::handle_404() should not have set a 404.' );
+
+                $sitemaps->render_sitemaps();
+
+                $this->assertTrue( is_404(), 'render_sitemaps() should have set a 404.' );
+        }
 }