IndexNow: How It Works and How to Set It Up

IndexNow is an open protocol that lets a website tell search engines the moment a URL is added, updated or deleted. You prove ownership of the host with a key file, then send the changed URLs in a simple HTTP request. Microsoft Bing, Yandex, Naver, Seznam.cz, Yep and a few others accept it, and they share submissions with each other. Google does not take part.

Why bother if Google ignores it

Because the engines that do use it cover more ground than their own search boxes. Bing's index also supplies results to DuckDuckGo, Yahoo and Ecosia, and it is used for grounding by Microsoft Copilot and ChatGPT search. If a new page is in Bing within minutes, it is available to all of those.

The other reason is cost. Setup is one text file and one HTTP call. Compared with waiting for a crawler to come back to your sitemap, it is the cheapest speed improvement on offer for non-Google search.

How the protocol works

1. You generate a key: 8 to 128 characters, using only a-z, A-Z, 0-9 and hyphens.
2. You host a UTF-8 text file containing that key on your site, to prove you control the host.
3. When a URL changes, you send it with the key to an IndexNow endpoint.
4. The receiving engine checks the key file, accepts the URLs, and shares them with the other participants.
5. Each engine decides by itself when to crawl and whether to index.

Step 1: create and host the key file

Generate a key. Any random hex string works:

openssl rand -hex 16
# 7e3f9c0a5b1d4e2f8a6c0d9b3e1f7a25

Create a file named after the key, containing only the key, at the root of the host:

https://www.example.com/7e3f9c0a5b1d4e2f8a6c0d9b3e1f7a25.txt

File content:

7e3f9c0a5b1d4e2f8a6c0d9b3e1f7a25

Check that it returns status 200 as plain text, with no HTML wrapper, no redirect to a login page and no extra whitespace beyond a trailing newline.

Hosting the key somewhere else

If you cannot write to the root, host the file at another path and pass its location with the keyLocation parameter. There is a catch: a key file in a subdirectory only authorises URLs under that directory. A key at https://www.example.com/catalog/key.txt can be used for /catalog/... URLs and nothing else. Root placement avoids the restriction.

One key per host

The key file validates a single host. www.example.com, example.com and blog.example.com each need to serve a key file. You may reuse the same key value on each, but the file has to exist on every host you submit for.

Step 2: submit URLs

A single URL with GET

https://api.indexnow.org/indexnow?url=https%3A%2F%2Fwww.example.com%2Fnew-page&key=7e3f9c0a5b1d4e2f8a6c0d9b3e1f7a25

The url value must be URL encoded. Add &keyLocation=<encoded URL> only if the key file is not at the root under its own name.

Many URLs with POST

curl -i -X POST "https://api.indexnow.org/indexnow" \
  -H "Content-Type: application/json; charset=utf-8" \
  -d '{
    "host": "www.example.com",
    "key": "7e3f9c0a5b1d4e2f8a6c0d9b3e1f7a25",
    "keyLocation": "https://www.example.com/7e3f9c0a5b1d4e2f8a6c0d9b3e1f7a25.txt",
    "urlList": [
      "https://www.example.com/new-page",
      "https://www.example.com/updated-page",
      "https://www.example.com/deleted-page"
    ]
  }'

Rules for the payload:

• Up to 10,000 URLs per request.
• Every URL must belong to the host in the body. Mixing http and https URLs of the same host is allowed.
• keyLocation is optional when the key file is at the root and named <key>.txt.

Endpoints

Endpoint	Operated by
https://api.indexnow.org/indexnow	The shared IndexNow endpoint
https://www.bing.com/indexnow	Microsoft Bing
https://yandex.com/indexnow	Yandex
https://searchadvisor.naver.com/indexnow	Naver
https://search.seznam.cz/indexnow	Seznam.cz
https://indexnow.yep.com/indexnow	Yep

You only need one. The protocol requires participants to share submitted URLs with the others, so posting to api.indexnow.org reaches everyone. The current participant list on indexnow.org also includes Amazon and the Internet Archive.

Step 3: read the response

Code	Meaning	What to do
200 OK	URLs received	Nothing
202 Accepted	URLs received, key validation still pending	Usually nothing. Make sure the key file is reachable
400 Bad Request	Invalid format	Check the JSON, the content type and URL encoding
403 Forbidden	Key not valid: file not found, or its content does not match	Open the key file URL in a browser and compare it with the key you sent
422 Unprocessable Entity	URLs do not belong to the host, or the key does not match the schema	Check the host value, www versus non-www, and the allowed key characters
429 Too Many Requests	Too many requests, seen as potential spam	Slow down and only send changed URLs

A 200 means "received". It says nothing about crawling or indexing. To see what happened next, use Bing Webmaster Tools: it has an IndexNow section listing submitted URLs, and its URL Inspection feature shows the index status of a given page.

The most common failure is a 403 caused by a host mismatch: the key file is on www.example.com and the request says "host": "example.com", or the non-www version redirects so the file is never fetched directly.

What to submit and when

Submit a URL when:

• A new page is published.
• The meaningful content of a page changes.
• A page is deleted or starts redirecting. Submitting a URL that now returns 404, 410 or 301 lets engines process the removal or the move sooner.

Do not submit:

• Your full URL list on a schedule "just in case".
• URLs that did not change.
• URLs that are blocked by robots.txt or set to noindex. The engine will only find out it is not allowed to use them.

The cleanest trigger is an event in your CMS: on publish, on update, on delete. If you cannot hook into events, diff your sitemap: compare today's URLs and <lastmod> values with yesterday's and send only the differences. That only works if your lastmod is truthful, which is covered in lastmod best practices.

You may already have it

Several platforms send IndexNow pings without any work from you:

• Cloudflare: the Crawler Hints setting notifies IndexNow participants when cached content changes.
• WordPress: Microsoft publishes an official IndexNow plugin, and major SEO plugins such as Rank Math and Yoast (in its premium version) include it.
• Hosted builders: Wix and Duda have built-in integrations, and Shopify stores can add it through apps.

Check before building your own, so you are not submitting every change twice.

For one-off submissions, the IndexNow Submitter sends a list of URLs for you once your key file is in place. TurboIndex also sends IndexNow notifications automatically when it detects new or changed URLs in your sitemap, alongside its Google submissions.

A minimal implementation

A Node.js function you can call from a publish hook:

const KEY = process.env.INDEXNOW_KEY;
const HOST = "www.example.com";

export async function notifyIndexNow(urls) {
  if (!urls.length) return;
  const res = await fetch("https://api.indexnow.org/indexnow", {
    method: "POST",
    headers: { "Content-Type": "application/json; charset=utf-8" },
    body: JSON.stringify({
      host: HOST,
      key: KEY,
      keyLocation: `https://${HOST}/${KEY}.txt`,
      urlList: urls.slice(0, 10000),
    }),
  });
  if (res.status !== 200 && res.status !== 202) {
    console.warn("IndexNow rejected the request:", res.status);
  }
}

Log the response code, queue and retry on network errors, and back off on 429. Do not block the publish action on the result.

Is the key a secret?

Not really. The key file is publicly readable by design, so anyone can see your key. What someone could do with it is submit URLs of your own host, which only makes search engines crawl your pages. They cannot submit other hosts with it, and they cannot change your content. If a key is being abused, generate a new one and delete the old file.

Common mistakes

Key file served as HTML. Single page applications and catch-all routes often return the app shell with status 200 for any path. The engine reads HTML instead of the key and answers 403. Request the file with curl and look at the raw body.

Key file blocked. A robots.txt disallow, a firewall rule or a country block in front of the .txt file stops validation.

Wrong host string. host takes a bare hostname such as www.example.com, with no protocol and no path.

Treating it as a replacement for sitemaps. IndexNow is a change notification. Sitemaps remain the complete inventory, and Google relies on them. Keep both. The XML sitemap guide covers that side.

Expecting Google results. For Google, faster discovery comes from sitemaps, internal links and, for eligible job posting and livestream pages, the Indexing API. See the Google Indexing API guide.

Forgetting Bing Webmaster Tools. IndexNow works without an account, but without one you cannot see what Bing did with your URLs. Setting it up takes minutes, and it is described in how to submit a URL to Bing.