Changeset 63575

Timestamp:

09/10/2026 01:09:53 AM (4 weeks ago)

Author:

westonruter

Message:

Sitemaps: Don't 404 valid sitemaps on sites with no posts.

WP::handle_404() sets a 404 when the main query matches no posts and no exception applies. Sitemap requests were never among those exceptions; they were shielded only incidentally, by falling through to is_home, and in r62664 that fallthrough was removed. A site with no published posts therefore served a complete, valid sitemap under a 404 status, which search engines discard.

Exempt sitemap and stylesheet routes there, alongside the existing admin, robots and favicon exceptions. Since handle_404() no longer decides the status for these requests, every sitemap 404 now has to be issued by WP_Sitemaps::render_sitemaps() instead: an unregistered provider, an unrecognized stylesheet type, and a route whose query vars do not survive sanitize_text_field() would each otherwise be served as a 200 on an arbitrary URL. These share a send_404() helper, which also sends the no-cache headers handle_404() was previously contributing, so an intermediary does not retain a 404 for a route that becomes valid once the site has more content.

Sitemaps disabled via the wp_sitemaps_enabled filter, and providers with an empty URL list, keep the status they already had; whether the latter should render an empty sitemap instead is #61293.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13247.
Follow-up to r48072, r48523, r62664.

Reviewed by adamsilverstein.
Merges r63570 to the 7.1 branch.
Merged to the 7.0 branch in error in r63573 and reverted in r63574.

Props iamchitti, westonruter, fernandot, wildworks, harishtewari, l1onofjudah, luksusspokoju, abrahamfariaz, andreasca, siliconforks, adamsilverstein, audrasjb, ocean90, mrkenobi.
See #39157, #61293.
Fixes #65945.

Location:

branches/7.1

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp.php (modified) (1 diff)
• src/wp-includes/sitemaps/class-wp-sitemaps.php (modified) (6 diffs)
• tests/phpunit/tests/sitemaps/sitemaps.php (modified) (1 diff)
• tests/phpunit/tests/wp/handle404.php (copied) (copied from trunk/tests/phpunit/tests/wp/handle404.php )

branches/7.1/src/wp-includes/class-wp.php

@@ -747 +747 @@
                 $set_404 = true;
 
-                // Never 404 for the admin, robots, or favicon.
-                if ( is_admin() || is_robots() || is_favicon() ) {
+                // Never 404 here for the admin, robots, favicon, or sitemaps.
+                // Sitemap routes send their own status in WP_Sitemaps::render_sitemaps().
+                if ( is_admin() || is_robots() || is_favicon() || is_sitemap() || get_query_var( 'sitemap-stylesheet' ) ) {
                         $set_404 = false;
 

branches/7.1/src/wp-includes/sitemaps/class-wp-sitemaps.php

@@ -158 +158 @@
          *
          * @since 5.5.0
-         *
-         * @global WP_Query $wp_query WordPress Query object.
          */
         public function render_sitemaps() {
-                global $wp_query;
+                /*
+                 * Bail early if this isn't a sitemap or stylesheet route.
+                 *
+                 * This runs on every front-end request, so it comes before any
+                 * sanitizing. The raw query vars are tested here, matching
+                 * WP::handle_404(), which exempts sitemap requests from its own 404 on
+                 * the same basis. Testing the sanitized values instead would let a
+                 * request that handle_404() exempted fall through both, leaving it a 200.
+                 */
+                if ( ! get_query_var( 'sitemap' ) && ! get_query_var( 'sitemap-stylesheet' ) ) {
+                        return;
+                }
 
                 $sitemap         = sanitize_text_field( get_query_var( 'sitemap' ) );
@@ -169 +178 @@
                 $paged           = absint( get_query_var( 'paged' ) );
 
-                // Bail early if this isn't a sitemap or stylesheet route.
+                // Force a 404 and bail early if the route did not survive sanitizing.
                 if ( ! ( $sitemap || $stylesheet_type ) ) {
+                        $this->send_404();
                         return;
                 }
 
                 if ( ! $this->sitemaps_enabled() ) {
-                        $wp_query->set_404();
-                        status_header( 404 );
+                        $this->send_404();
                         return;
                 }
@@ -182 +191 @@
                 // Render stylesheet if this is stylesheet route.
                 if ( $stylesheet_type ) {
+                        // Force a 404 and bail early if the stylesheet type is not recognized.
+                        if ( ! in_array( $stylesheet_type, array( 'sitemap', 'index' ), true ) ) {
+                                $this->send_404();
+                                return;
+                        }
+
                         $stylesheet = new WP_Sitemaps_Stylesheet();
 
@@ -198 +213 @@
                 $provider = $this->registry->get_provider( $sitemap );
 
+                // Force a 404 and bail early if the requested provider is not registered.
                 if ( ! $provider ) {
+                        $this->send_404();
                         return;
                 }
@@ -210 +227 @@
                 // Force a 404 and bail early if no URLs are present.
                 if ( empty( $url_list ) ) {
-                        $wp_query->set_404();
-                        status_header( 404 );
+                        $this->send_404();
                         return;
                 }
@@ -217 +233 @@
                 $this->renderer->render_sitemap( $url_list );
                 exit;
+        }
+
+        /**
+         * Sends a 404 for a sitemap route that cannot be served.
+         *
+         * WP::handle_404() exempts sitemap requests, so every sitemap 404 is issued
+         * here instead. That includes the no-cache headers handle_404() sends with
+         * its own 404, so an intermediary does not retain a 404 for a route that
+         * becomes valid once the site has more content.
+         *
+         * @since 7.1.1
+         *
+         * @global WP_Query $wp_query WordPress Query object.
+         */
+        private function send_404(): void {
+                global $wp_query;
+
+                $wp_query->set_404();
+                status_header( 404 );
+                nocache_headers();
         }
 

branches/7.1/tests/phpunit/tests/sitemaps/sitemaps.php

@@ -494 +494 @@
                 $this->assertTrue( is_404() );
         }
+
+        /**
+         * Ensures a paged subtype route with no URLs still 404s, now that
+         * WP::handle_404() no longer sets a 404 for sitemap requests.
+         *
+         * @ticket 65945
+         */
+        public function test_empty_url_list_for_subtype_should_return_404() {
+                wp_register_sitemap_provider( 'foo', new WP_Sitemaps_Empty_Test_Provider( 'foo' ) );
+
+                $this->go_to( home_url( '/?sitemap=foo&sitemap-subtype=bar&paged=2' ) );
+
+                wp_sitemaps_get_server()->render_sitemaps();
+
+                $this->assertTrue( is_404() );
+        }
+
+        /**
+         * Ensures a sitemap query var that does not survive sanitizing 404s.
+         *
+         * WP::handle_404() exempts these requests on the raw query var, while
+         * render_sitemaps() acts on the sanitized value. Without a matching bail
+         * they fall through both and an arbitrary URL is served as a 200.
+         *
+         * @ticket 65945
+         *
+         * @dataProvider data_unusable_sitemap_query_vars
+         *
+         * @param non-falsy-string $query_string Query string to append to a nonexistent URL.
+         */
+        public function test_unusable_sitemap_query_var_should_return_404( string $query_string ) {
+                $this->set_permalink_structure( '/%postname%/' );
+
+                // Instantiate the server before navigating: registering the sitemap
+                // rewrite tags is what adds the query vars to `$wp->public_query_vars`.
+                $sitemaps = wp_sitemaps_get_server();
+
+                $this->go_to( home_url( '/this-page-does-not-exist/' . $query_string ) );
+
+                $this->assertFalse( is_404(), 'WP::handle_404() should not have set a 404.' );
+
+                $sitemaps->render_sitemaps();
+
+                $this->assertTrue( is_404(), 'render_sitemaps() should have set a 404.' );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array<non-falsy-string, array{ non-falsy-string }>
+         */
+        public function data_unusable_sitemap_query_vars(): array {
+                return array(
+                        'value stripped by sanitizing' => array( '?sitemap=<>' ),
+                        'array sitemap value'          => array( '?sitemap[]=index' ),
+                        'array stylesheet value'       => array( '?sitemap-stylesheet[]=sitemap' ),
+                );
+        }
+
+        /**
+         * Ensures an unrecognized stylesheet type 404s from render_sitemaps().
+         *
+         * WP::handle_404() exempts any request carrying a `sitemap-stylesheet`
+         * query var, and WP_Sitemaps_Stylesheet::render_stylesheet() echoes nothing
+         * for a type other than 'sitemap' or 'index', so this route would otherwise
+         * be served as a 200 with an empty body.
+         *
+         * @ticket 65945
+         */
+        public function test_unrecognized_stylesheet_type_should_return_404() {
+                // Instantiate the server before navigating: registering the sitemap rewrite
+                // tags is what adds `sitemap-stylesheet` to `$wp->public_query_vars`.
+                $sitemaps = wp_sitemaps_get_server();
+
+                $this->go_to( home_url( '/?sitemap-stylesheet=this-is-not-a-stylesheet' ) );
+
+                $this->assertFalse( is_404(), 'WP::handle_404() should not have set a 404.' );
+
+                $sitemaps->render_sitemaps();
+
+                $this->assertTrue( is_404(), 'render_sitemaps() should have set a 404.' );
+        }
+
+        /**
+         * Ensures an unregistered provider 404s from render_sitemaps().
+         *
+         * WP::handle_404() exempts every sitemap request, so this route would
+         * otherwise be served with a 200.
+         *
+         * @ticket 65945
+         */
+        public function test_unregistered_provider_should_return_404() {
+                // Instantiate the server before navigating: registering the sitemap
+                // rewrite tags is what adds `sitemap` to `$wp->public_query_vars`.
+                $sitemaps = wp_sitemaps_get_server();
+
+                $this->go_to( home_url( '/?sitemap=this-provider-does-not-exist' ) );
+
+                $this->assertFalse( is_404(), 'WP::handle_404() should not have set a 404.' );
+
+                $sitemaps->render_sitemaps();
+
+                $this->assertTrue( is_404(), 'render_sitemaps() should have set a 404.' );
+        }
 }