I have a wholesale price page I do not want everyone to see. Is it safe to put it in my sitemap?
No. Anyone can open your site address followed by /sitemap.xml and read every link in it, so adding a private page there announces it. Leave the page out of the sitemap and protect it with a password or a login. In the tool, deleting its line from the list is enough, because the file contains only what you give it.
A sitemap is public by design
Sitemaps are made for search engines to read, but nothing stops anyone else. A curious competitor, a retail customer or a link-harvesting bot can open it in a browser like any page. The file is plain text, so a link like https://example.com/wholesale-prices-2026 explains itself.
The same goes for robots.txt: write a Disallow line for the wholesale page to hide it and you have published its path in another public file. robots.txt is a request to polite crawlers, not a lock.
An unlisted link is not protection
Many people rely on the link being one 'nobody knows'. But links leak: a WhatsApp message a customer forwards, a screenshot, the browser history on a shared computer. A page with no password is a public page, however long or odd its address. Nor can we promise a search engine will not find it some other way.
What actually protects the page
- A login: a dedicated account for wholesale buyers. Many store platforms offer customer groups or special pricing; check your platform's documentation.
- A password on the page or folder, if your site is on your own hosting.
- Sending the price list as a file directly to approved buyers instead of a page on the site.
In the tool: deleting the line is enough
- Review the list before pasting it into the XML sitemap generator, looking for words like wholesale, private, admin or test.
- Delete those lines. The tool adds no URL you did not give it and never discovers your pages by itself.
- After downloading, open the file and search it for the same words to be sure.
- If an earlier upload already listed the page, replace it with the new file. But assume the old link is known, and protect the page.
What about hosted stores?
On Salla, Zid or Shopify the platform builds the sitemap itself and may include every published page. Open your store's sitemap and check whether your private page is in it. If it is, the fix is not in the sitemap but in the page's own settings: hiding it or limiting it to a customer group, as far as the platform allows. For a robots.txt on a site you host yourself, use the Robots.txt builder, remembering it is not a protection tool.
Common questions
Is the sitemap the only way a page reaches search results?
No. Search engines also find pages through links, so leaving it out of the sitemap does not stop it appearing.
Does the tool keep my list of URLs?
No, the list is processed inside your browser and not sent to any server.
Should I block the page in robots.txt instead?
That does not hide it; it publishes the path in a public file. Real protection is a login.