Permissions & Security

Control access to your sitemaps with role-based permissions. Every endpoint is protected and requires explicit permission grants.

Permission System

Strapi Advanced Sitemap uses Strapi’s built-in permission system. Every sitemap endpoint maps to a specific action that must be granted to a role before access is allowed.

Available Actions

All actions are prefixed with plugin::strapi-advanced-sitemap.controller.*:

Granting Permissions

To make your sitemaps publicly accessible:

• Navigate to Settings → Users & Permissions → Roles
• Select the role you want to grant access to (typically Public for search engines)
• Scroll to the Strapi Advanced Sitemap section
• Enable the actions you want to allow:
  • For public search engine access, enable all four actions
  • For restricted access, enable only specific actions
• Click Save

Public Role Configuration

For search engines to crawl your sitemaps, grant permissions to the Public role:

Recommended: Enable all four actions for the Public role to allow full sitemap access.

• serveRootSitemap
• serveManualSitemapIndex
• serveManualSitemapFile
• serveCollectionSitemapFile

API Token Support

API tokens respect the same permission system:

• Tokens inherit permissions from their assigned role
• If a role doesn’t have access to a sitemap endpoint, tokens for that role will also be denied
• Use this to create programmatic access with controlled permissions

Security Best Practices

• Principle of least privilege: Only grant the minimum permissions needed
• Public access: Enable sitemap actions for Public role only if you want search engines to crawl them
• Restricted access: Use authenticated roles for internal or private sitemaps
• Monitor access: Review your permission settings regularly
• Test permissions: Verify that unauthorized access returns 401 Unauthorized

Access Denied Behavior

When a role doesn’t have permission to access a sitemap endpoint:

• The request returns 401 Unauthorized
• No sitemap content is returned
• Search engines will not be able to crawl the sitemap

Important: If your sitemaps return 401, check that the appropriate permissions are enabled for the requesting role.

Manual Sitemap Security

Manual sitemaps store relative paths only—final URLs are resolved server-side:

• URLs are combined with your configured base URL at request time
• This prevents exposing internal URLs or configuration details
• Base URL can be changed without updating individual entries

Issues & Fixes: Permissions

If you’re experiencing permission issues:

• Verify the role has the required action enabled
• Check that you clicked Save after enabling permissions
• Ensure you’re testing with the correct role (Public for unauthenticated requests)
• Review the Issues & Fixes guide for common issues