<?xml version="1.0" encoding="UTF-8"?>
<!--
  sitemap.xml for nailsbyaneka.com — PUBLIC pages only.

  SERVED BY: Cloudflare Pages, as a plain static file at the deploy root. It is
  staged by worker/scripts/deploy-site.sh (which deploys a clean temp dir, not
  the repo) — if you add a public page, add it BOTH here and to that script's
  copy list, or the new page will be missing from the live sitemap.

  URL FORM: absolute https:// and EXTENSIONLESS. Cloudflare Pages 308-redirects
  /services.html -> /services, so listing the .html form would fill the sitemap
  with redirects. These must match each page's <link rel="canonical"> exactly.

  DELIBERATELY ABSENT — do not add these:
    • /admin            — private admin dashboard (auth)
    • /booking-lookup   — customer booking lookup/cancel/consent-withdrawal
    • /reset-password   — password reset flow
  All three are Disallowed in robots.txt and carry <meta name="robots"
  content="noindex, nofollow">. A sitemap entry would contradict both.

  lastmod: the date each page's content or metadata last genuinely changed.
  Do not bulk-refresh these to "today" — Google discounts lastmod it finds to
  be unreliable, and an honest stale date is worth more than a fresh fake one.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

  <url>
    <loc>https://nailsbyaneka.com/</loc>
    <lastmod>2026-08-05</lastmod>
  </url>

  <url>
    <loc>https://nailsbyaneka.com/services</loc>
    <lastmod>2026-08-05</lastmod>
  </url>

  <url>
    <loc>https://nailsbyaneka.com/gallery</loc>
    <lastmod>2026-08-05</lastmod>
  </url>

  <url>
    <loc>https://nailsbyaneka.com/booking</loc>
    <lastmod>2026-08-05</lastmod>
  </url>

  <url>
    <loc>https://nailsbyaneka.com/faq</loc>
    <lastmod>2026-08-05</lastmod>
  </url>

  <url>
    <loc>https://nailsbyaneka.com/terms</loc>
    <lastmod>2026-08-05</lastmod>
  </url>

  <url>
    <loc>https://nailsbyaneka.com/privacy</loc>
    <lastmod>2026-08-05</lastmod>
  </url>

</urlset>
