How is ownership verified for IndexNow submissions?

Definition: As of 17 October 2026, IndexNow verifies control of a website host by fetching a text file containing the key supplied with URL submissions. The file sits at the host's root or at another location on the same host declared through keyLocation.

Key facts

• IndexNow's protocol documentation requires a UTF-8 text file containing the submission key and recommends placing it at the website root.
• IndexNow's FAQ requires the key file to be publicly accessible without login, firewall or IP restrictions.
• Microsoft's IndexNow setup guide supports a root file or another location within the same host, with keyLocation identifying the alternative file.

How does a root key file work?

IndexNow is a protocol for notifying participating search engines when a URL is added, updated or deleted. A host is the website name in the URL, such as www.example.com. IndexNow's documentation requires proof of control over the host whose URLs are submitted: search engines fetch the hosted key file after receiving submissions and use the key until it changes.

The root directory is the top level of the website's URL paths. The default filename is the key followed by .txt. IndexNow's FAQ gives abcd1234 as an example key, producing a file named abcd1234.txt whose contents are:

abcd1234

The file must use UTF-8 encoding. The FAQ specifies keys from 8 to 128 characters, allowing letters, digits and hyphens. With the default root filename, submissions supply the matching key; an alternative location requires the additional parameter described below.

Which alternative locations are supported?

IndexNow's documentation permits one or more key files elsewhere on the same host. Each notification using an alternative location must include keyLocation, the full URL of the key file. For an individual URL submission, it is a request URL parameter. For a batch submission, it is a field in the JSON request body.

The following JSON adapts the documentation's request structure using the FAQ's example key. It declares an alternative filename at the website root:

{
  "host": "www.example.com",
  "key": "abcd1234",
  "keyLocation": "https://www.example.com/myIndexNowKey63638.txt",
  "urlList": [
    "https://www.example.com/product.html"
  ]
}

That file must contain abcd1234. Its directory determines which URLs the key covers. The documentation's example places a file at http://example.com/catalog/key12457EDd.txt: that location covers URLs beginning with http://example.com/catalog/, while URLs under http://example.com/help/ fall outside its scope. A file at the root avoids this subfolder restriction.

How can verification problems be checked?

IndexNow's FAQ instructs site owners to open the key file's URL in a browser and check that it displays only the matching key as plain text. Access must work without authentication or network restrictions.

The protocol's response table distinguishes submission results:

• HTTP 202 means the URL is received and key validation is pending.
• HTTP 403 indicates an invalid key, including a missing file or a file without the expected key.
• HTTP 422 covers URLs outside the host or a key that fails the protocol's format requirements.

HTTP 200 confirms receipt of the submission. Search engines subsequently evaluate whether to crawl the submitted URL, according to the FAQ.

Related terms

• IndexNow
• Does IndexNow ensure that a URL is indexed?
• HTTP status codes

FAQ

Does a key on the main website cover its subdomains?

IndexNow's FAQ treats each subdomain as a separate host. You need an individual key file for each subdomain and submit its URLs with that subdomain's key.

How do I rotate the key?

The same FAQ instructs you to generate a new key, replace the old root file with the new key's .txt file, and begin submitting with the new key. The next submission prompts search engines to verify the replacement key.

Sources

1. IndexNow, "Documentation", undated
2. IndexNow, "FAQ", undated
3. Microsoft Bing, "How to add IndexNow to your website", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer