Your sitemap says index, the page says noindex

A sitemap is a list of pages you are asking Google to index. A noindex tag is an instruction not to index a page. When the same URL carries both, you have told Google two opposite things, and Google resolves it against you every time.

What does this check detect?

Moonleap fetches the sitemap (and sitemap index files), requests each URL as an anonymous visitor, and reads the robots meta tag and response headers. The finding lists the exact URLs. On the site in the case below there were two: /login and /register.

Why does it matter?

1. Crawl budget. Google fetches the URL because the sitemap asked it to, reads the noindex, and drops it. On a small site that is a rounding error; on a site with hundreds of parameter pages in the sitemap it is a real share of the crawl.
2. Trust in the sitemap. Google's documentation asks that sitemap URLs be canonical, indexable pages. A sitemap that keeps listing pages Google is told to drop is a sitemap Google leans on less for the pages that matter.
3. Noise in the report. The Page indexing report shows these URLs under "Excluded by noindex tag" with the source "Submitted URL". Every time you check that report for a real problem, you scan past rows you created yourself.

There is also the plain fact that the two signals mean you did not decide. Either the page should be indexed (remove the noindex) or it should not (remove it from the sitemap).

How did this happen on a real site?

The site is a SvelteKit app. Its sitemap.xml route had a hard-coded array of public paths, and /login and /register were in it from the first version, when both pages were meant to be indexed. When the pages were given a noindex tag (a login form has nothing to rank for), the sitemap kept listing them. The site's sitemap went from 63 URLs to 61 after the fix; the change was two lines.

What is the fix?

SvelteKit, src/routes/sitemap.xml/+server.ts: keep one list of public paths and filter out anything marked private.

const PAGES = [
  { path: '/', priority: '1.0' },
  { path: '/pricing', priority: '0.8' },
  // { path: '/login' }  <- removed: the page is noindex
];

Next.js (App Router), app/sitemap.ts: build the list from the same data source that decides robots: { index: false } in your metadata, and exclude those entries.

export default function sitemap() {
  return pages
    .filter((p) => p.index !== false)
    .map((p) => ({ url: `https://<your-domain>${p.path}`, lastModified: p.updated }));
}

Astro with @astrojs/sitemap: use the filter option.

sitemap({ filter: (page) => !page.includes('/login') && !page.includes('/register') })

Hosted platforms (Shopify, Webflow, Squarespace) generate the sitemap for you and do not let you edit it. There the fix is the other way round: do not set noindex on a page the platform insists on listing; unpublish it, password-protect it, or leave it indexable.

How do you verify the fix?

Now, from a terminal, list every sitemap URL whose page carries a noindex tag. The count should be zero.

curl -s https://<your-domain>/sitemap.xml | grep -o '<loc>[^<]*' | sed 's/<loc>//' \
| while read u; do curl -s "$u" | grep -qi 'name="robots"[^>]*noindex' && echo "$u"; done

In a few days, open Search Console, Indexing, Pages, and look at "Excluded by noindex tag". The rows with source "Submitted URL" should disappear as Google recrawls the sitemap. Search Console lags two to three days behind the crawl.

FAQ

Should login and account pages be in the sitemap at all?

No. A sitemap is for pages you want found in search. Login, register, password reset, cart and account pages have nothing to rank for; keep them out of the sitemap and mark them noindex.

Is it enough to remove the page from the sitemap and keep the noindex?

Yes, if you do not want the page indexed. Google may still discover it through links, read the noindex, and leave it out, which is the intended outcome.

Does robots.txt Disallow do the same job?

No. Disallow blocks crawling, so Google never sees the noindex and may index the URL from links alone, without content. Use noindex for "do not index" and keep such pages crawlable.