By Jody in Releases —

0.49.0: Sitemaps, Robots.txt and Smarter HTTPS Detection

Version 0.49.0 is out. This release focuses on SEO: every site now serves a sitemap.xml and a robots.txt with no configuration, along with a fix that stops URLs coming out as http behind some proxies.

Automatic sitemap.xml

Your site now serves a sitemap at /sitemap.xml. It includes:

  • your home page
  • published, public posts
  • published, public pages
  • tags
  • author pages

Drafts and members-only content are left out, so search engines never see anything that isn't meant to be public. Entries are ordered most recently published first. Each post and page carries a <lastmod> taken from its publish date.

If you have the docs feature enabled, your docs pages are added to the sitemap too.

Adding your own entries

The sitemap is extensible. Anything that includes the sitemappable model joins the sitemap automatically, and a model can declare a usedAsSitemappable scope to control which rows appear:

this.include('sitemappable');

this.scope('usedAsSitemappable', function(enabled = false){
    if(!enabled) return;
    return this.where({ published: true, access: 'public' });
});

For URLs that aren't backed by a database row, use the new sitemapEntries hook. Return an array of { path, lastmod? } objects, where path is host-relative with no leading slash:

this.addHook('sitemapEntries', async function(){
    return [
        { path: 'changelog' },
        { path: 'pricing', lastmod: '2026-09-01' }
    ];
});

robots.txt

There is now a /robots.txt too. It allows all crawlers and points them at your sitemap:

User-agent: *
Allow: /
Sitemap: https://example.com/sitemap.xml

The sitemap URL is built from the host the request came in on, so it is correct for custom domains and multi-tenant setups with no extra configuration.

Correct https URLs behind proxies

Some reverse proxies and hosting platforms terminate TLS but don't pass on an x-forwarded-proto header. Previously the server fell back to its own listener protocol in that case. Absolute URLs could therefore come out as http:// on a site that was actually served over HTTPS.

The rules are now:

  • If x-forwarded-proto is present, it is trusted, as before.
  • If it is missing and the host is not a loopback address (localhost, 127.0.0.1, [::1]), https is assumed.
  • Loopback hosts keep the listener's protocol, so local development over http is unchanged.

This matters most for the new sitemap and robots.txt, where absolute URLs need the right scheme for search engines to accept them.

Demo: Stripe CLI compatibility

This one is for contributors. The demo's start server command now passes an explicit event list (customer.subscription.created and customer.subscription.deleted) to stripe listen. Stripe CLI 1.51.0 requires this, and without it webhook forwarding failed to start.

Upgrading

Bump your packages to 0.49.0. No migrations or configuration changes are needed. Once deployed, visit /sitemap.xml and /robots.txt to check they are there. Then consider submitting the sitemap URL to Google Search Console and Bing Webmaster Tools.