Unfinished-site tells: hello-world slugs in your sitema...

When the Mega Analyzer prints CMS-default placeholder content indexed publicly (N URLs) in red, or Dev-placeholder text detected in production (N locations) on the brand and copy card, it is not grading your writing. It is reporting that the site still carries the factory defaults a CMS ships with, and that those defaults are visible to Google, to AI search engines, and to anyone who runs a site: query on your domain. The pass wording for the first detector is No CMS-default placeholder slugs detected in sitemap. The second detector has no pass row; it appears only when it has something to show you.

What the check actually tests

Two detectors sit behind this label, and they read different parts of the site.

Detector one: sitemap slugs. This row renders in the analyzer's Crawl Health section (the robots.txt and sitemap block, not the later section on soft 404s and canonical bleed) and runs only when a sitemap was actually fetched. The analyzer tries /sitemap.xml, then falls back through /sitemap_index.xml, /wp-sitemap.xml, /sitemap-index.xml, /sitemap1.xml and /sitemap.xml.gz, then reads any Sitemap: line in robots.txt. If none of those produce a file, neither the pass row nor the fail row renders. Once it has the file, every <loc> is tested against one regular expression of unmodified CMS defaults: hello-world, sample-page, sample-post, untitled-post (also -page, -draft, or bare untitled), blog-post-title-one through -five or any number, coming-soon, placeholder (with optional -page or -post), lorem-ipsum, new-page, new-post, test-page, test-post, test123, page-title, my-first-post, my-first-page, default-page and default-post. Each may be followed by up to three segments of four to eight random letters and digits, the random tail Squarespace adds to slugs it has to keep unique, so /news/blog-post-title-one-k2m9x-p7qhw/ trips it just as /hello-world/ does.

The fail row is rated critical. Its detail opens "CRITICAL: The sitemap contains URL slugs that are unmodified CMS defaults," lists up to three offending paths with a count of the rest, and gives the three-way fix: delete the post in the CMS, replace it with real content and a real slug, or set it to draft, then resubmit the sitemap in Search Console. The pass row is informational: "No "hello-world" / "sample-page" / "blog-post-title-one" / "untitled-post" / "coming-soon" defaults found."

What does not trip it matters as much. The regex is anchored to the end of the URL, so /news/hello-world/ fails but /hello-world/pricing/ does not. A one-character suffix does not meet the four-to-eight rule, so /hello-world-2/ slips through. The test is on sitemap text only: a placeholder that is published but missing from the sitemap passes, and a placeholder that carries a noindex tag but is still listed fails, because the sitemap is still asking for it. The biggest gap is the sitemap index. When a site's first sitemap file is an index (Yoast's sitemap_index.xml and WordPress core's wp-sitemap.xml both are), the <loc> entries the analyzer sees are child sitemap URLs like /post-sitemap.xml, not page URLs, and it does not open the children. A green row on a sitemap-index site is not proof. Run the child sitemap through the Sitemap Audit, which walks indexes, before you call it clean.

Detector two: placeholder text. This is check R10-2 on the Round 10 brand and copy card. It takes four slots from the fetched page: the <title>, the meta description, every H1 joined into one string, and the first 4,000 characters of body text after scripts, styles, nav, header, footer, aside, forms and cookie banners have been stripped. Each slot is tested against a dozen patterns: gwapo and pogi (Filipino), guapo (Spanish), lorem ipsum, placeholder text, [enter X] (anything in square brackets starting with "enter"), TBD as a whole word in capitals, coming soon, under construction, sample text, your text here and tagline goes here. The scan stops at the first hit per slot, so "N locations" counts slots, never words, and the maximum is four. The detail line names the slot and the pattern, for example meta description: "gwapo", and ends with "Replace before deploy."

It does not look at H2s, alt text, footer text, or anything past the first 4,000 body characters, and lowercase "tbd" does not fire because that pattern is case-sensitive. "Coming soon" inside a nav link or footer is stripped before the scan ever sees it.

Why it matters

Google's sitemap guidance says to "include the URLs in your sitemap that you want to see in Google's search results." Under the protocol, a <loc> is "URL of the page," nothing softer. So a /hello-world/ entry is you, on the record, asking for a page nobody wrote to be indexed. Google calls a submitted sitemap "merely a hint," so indexing is not guaranteed, but the page returns 200 and you listed it, and when Google takes the hint the URL shows up in Search Console's Pages report and in a site: query beside your real pages. Any other crawler that reads the sitemap gets the same list. When I audited a lodging site earlier this year, a Squarespace blog-post-title-one placeholder with random suffix tails had been publicly indexed since 2023: three years of a lodging business telling every search engine that its blog began with an unfinished draft.

The content behind those slugs is byte-identical across the internet. WordPress's installer writes the default post with the body "Welcome to WordPress. This is your first post. Edit or delete it, then start writing!" and a Sample Page whose text is likewise identical on every install. The post's own body tells you to edit or delete it, and the project's first-steps tutorial closes with "don't forget to delete your test posts!" Google's helpful-content self-assessment asks whether content avoids "simply copying or rewriting" other sources and whether you are "mainly summarizing what others have to say without adding much value." A page identical to millions of others cannot answer either question well, and it sits under your domain.

Placeholder text has a more direct route to the public. Google "sometimes uses the meta description HTML element if it might give users a more accurate description of the page than content taken directly from the page." When that field holds a developer's filler, the filler is the snippet. In a May 2026 audit of a professional-services site, the case-studies page carried the meta description "Case studies listing gwapo" (Filipino for handsome, typed in as filler). Nobody on the editorial side recognizes a word like that, which is how filler in another language survives review. A placeholder H1 is exposed the same way: it is the page's stated topic to every crawler and assistant that reads it.

The sitemap detector is rated critical rather than warn because of who sees it. A prospect, a procurement officer, or a grant reviewer who lands on /sample-page/ from a search result does not think "CMS default." They think nobody maintains this site, and they generalize that to the business.

How to fix it

Step 1: find every instance. Paste the domain into the Mega Analyzer and read the Crawl Health section and the Round 10 card. Run the sitemap, or the child sitemaps if the site uses an index, through the Sitemap Audit. Then search Google three times with the phrase quoted: site:yourdomain.com "hello world", site:yourdomain.com "sample page", site:yourdomain.com "lorem ipsum". The analyzer tells you what is being requested; the index is the ground truth for what the public can see. The entry you are hunting looks like this:

<url>
  <loc>https://example.com/news/blog-post-title-one-k2m9x-p7qhw/</loc>
  <lastmod>2023-04-11</lastmod>
</url>

Step 2: delete, replace, or hide each URL.

Delete is the default for a true placeholder. WordPress: Posts, hover "Hello world!", Trash; Pages, hover "Sample Page", Trash. A trashed item already returns 404 on the public site; empty the Trash once you are sure. Squarespace: Pages, find the untitled or draft page (often in the Not Linked section), delete it or set it to Disabled. Wix: Pages, delete "New Page." A deleted URL should answer 404 or 410. Google treats all 4xx codes except 429 the same and says "the indexing pipeline removes the URL from the index if it was previously indexed." Do not let the CMS return a 200 with "page not found" in the body; Search Console reports that as a soft 404 and the URL lingers.

Replace when the slot deserves real content. Write the post, give it a slug that describes it, then redirect the old placeholder slug. The Slug Rename Helper finds every internal link to the old slug and emits the redirect lines. On Squarespace the mapping goes under Developer tools, URL mappings, one line per redirect, and the old URL must no longer exist for the 301 to work:

/news/blog-post-title-one-k2m9x-p7qhw -> /news/what-to-pack-for-a-week-at-the-lake 301

Hide only when the page must stay published, for example a template the CMS refuses to delete. Set it to draft where the platform allows, or add noindex:

<meta name="robots" content="noindex">

Google's condition applies: noindex only works if the page is not blocked by robots.txt, because the crawler has to read the tag. Remove the URL from the sitemap anyway; a sitemap that requests a page the page itself refuses is exactly the contradiction the analyzer flags.

Step 3: regenerate and resubmit. Most CMSs rebuild the sitemap on their own once the item is gone. Confirm the <loc> is no longer listed, then in Search Console open Indexing, Sitemaps, and resubmit. If the placeholder ranks for your brand name today, use Indexing, Removals for a temporary block while the index catches up. Google says a successful request "lasts only about six months," so the permanent fix is still the 404, 410, or noindex from step 2.

Step 4: placeholder text. Grep the theme or template repository, not the rendered HTML, for lorem, TBD, [enter, your text here, and whatever your developer's language uses for filler. Fix the template field or the content field the text comes from and redeploy. When the finding is a template edit, paste the URL into the Code-Diff Patch Generator to get the change as a unified diff you can apply. Then run the affected URLs through the Soft 404 Content Quality Overlay, which scores thin and placeholder pages and recommends 301, 410, noindex, or expand for each.

Step 5: prevent the next one. Add the analyzer's regex to a pre-deploy check that reads the built sitemap and the head of every built HTML file. This is the shape of the gate this site runs:

// scripts/check-placeholders.mjs (run before every deploy; exit 1 blocks it)
import fs from 'node:fs';
import path from 'node:path';

const SLUG_RE = /\/(?:hello[-_]world|sample[-_]page|sample[-_]post|untitled[-_]?(?:post|page|draft)?|blog[-_]post[-_]title[-_]?(?:one|two|three|four|five|[0-9]+)|coming[-_]?soon|placeholder[-_]?(?:page|post)?|lorem[-_]ipsum|new[-_]page|new[-_]post|test[-_]?(?:page|post|123)|page[-_]title|my[-_]first[-_](?:post|page)|default[-_]?(?:page|post))(?:-[a-z0-9]{4,8}){0,3}\/?$/i;
const TEXT_RE = /\blorem ipsum\b|\[enter [^\]]+\]|\byour text here\b|\bsample text\b|\btagline goes here\b|\bplaceholder text\b|\bgwapo\b|\bguapo\b/i;
const TBD_RE = /\bTBD\b/;

const problems = [];
const sitemap = fs.readFileSync('_site/sitemap.xml', 'utf8');
for (const m of sitemap.matchAll(/<loc>([^<]+)<\/loc>/g)) {
  if (SLUG_RE.test(m[1])) problems.push('sitemap slug: ' + m[1]);
}

function walk(dir) {
  for (const f of fs.readdirSync(dir, { withFileTypes: true })) {
    const p = path.join(dir, f.name);
    if (f.isDirectory()) { walk(p); continue; }
    if (!f.name.endsWith('.html')) continue;
    const html = fs.readFileSync(p, 'utf8');
    const head = html.match(/<title>[^<]*<\/title>|<meta name="description" content="[^"]*"/g) || [];
    const h1s = html.match(/<h1[^>]*>[\s\S]*?<\/h1>/gi) || [];
    for (const s of [...head, ...h1s]) {
      if (TEXT_RE.test(s) || TBD_RE.test(s)) problems.push(p + ': ' + s.slice(0, 80));
    }
  }
}
walk('_site');

if (problems.length) { console.error(problems.join('\n')); process.exit(1); }
console.log('placeholder check: clean');

Re-run the audit after every platform migration. Migrations recreate the defaults: the fresh WordPress install you import into still ships its own "Hello world!" beside your migrated posts, and a template switch on a hosted builder can bring the template's demo pages back under fresh slugs.

When to leave it alone

A real launch page at /coming-soon/ for a product with a date will fire the critical row. If the page has actual content (what is coming, when, how to be notified), the row is wrong about the content but right about the slug: /coming-soon/ will outlive the launch and become a stale URL. Rename it to the product and redirect. If you keep the slug, keep it knowingly and expect the row.

A post whose real slug ends in one of the listed words plus a short segment also matches. /new-page-builder/ fits new-page followed by a seven-character tail. The slug is fine and the row is noise; there is no allowlist in the analyzer, so read the example paths in the detail line before acting.

Detector two has a bigger honest exception: any page that discusses placeholders. A tutorial about WordPress defaults, a design-system page that documents your own filler conventions, or this article, all contain "lorem ipsum" in the body, and the body scan reports it. That is why the pre-deploy sample above scans only the title, description and H1s; on a content site a body scan needs an allowlist to be useful. A schedule table showing "TBD" for a date that truly is not set is a judgment call. If the page is public, write "date to be announced," which is what a reader needs and what the detector ignores.

Fact-check notes and sources

Source: https://developers.google.com/search/docs/crawling-indexing/sitemaps/build-sitemap establishes "Include the URLs in your sitemap that you want to see in Google's search results" and that "submitting a sitemap is merely a hint: it doesn't guarantee that Google will download the sitemap or use the sitemap for crawling URLs on the site."
Source: https://www.sitemaps.org/protocol.html establishes that <loc> is the "URL of the page" and that in a sitemap index a <loc> "identifies the location of the Sitemap," which is why the analyzer sees child sitemap URLs, not page URLs, when the first file is an index.
Source: https://developers.google.com/search/docs/crawling-indexing/http-network-errors establishes that "all 4xx errors, except 429, are treated the same," that "the indexing pipeline removes the URL from the index if it was previously indexed," and that a 200 whose content "suggests an error" is reported as a soft 404.
Source: https://support.google.com/webmasters/answer/9689846 establishes that a temporary removal "lasts only about six months" and that permanent removal needs a 404 or 410, password protection, or noindex.
Source: https://developers.google.com/search/docs/fundamentals/creating-helpful-content establishes the self-assessment questions about "simply copying or rewriting" other sources and "mainly summarizing what others have to say without adding much value."
Source: https://developers.google.com/search/docs/appearance/snippet establishes that snippets come primarily from page content and that Google "sometimes uses the meta description HTML element" when it may describe the page more accurately.
Source: https://developers.google.com/search/docs/crawling-indexing/block-indexing establishes the <meta name="robots" content="noindex"> and X-Robots-Tag: noindex forms and the rule that the page "must not be blocked by a robots.txt file" for noindex to work.
Source: https://developer.wordpress.org/reference/functions/wp_install_defaults/ establishes the default post "Hello world!" with slug hello-world, its body text, and the default "Sample Page" with slug sample-page.
Source: https://wordpress.org/documentation/article/first-steps-with-wordpress-classic/ establishes that on a fresh install "you only have one post" and that the tutorial closes with "don't forget to delete your test posts!"
Source: https://support.squarespace.com/hc/en-us/articles/205815308 establishes the URL mapping format /old-url -> /new-url 301, its location under Developer tools, and that "the original URL can no longer exist, and the new one must exist."
The regex list, the four-to-eight character suffix rule, the four scanned slots, the 4,000-character body limit and the one-hit-per-slot count come from the Mega Analyzer source at https://jwatte.com/tools/mega-analyzer/ (view source; search for placeholder_content_indexed and R10-2).

Unfinished-site tells: hello-world slugs in your sitemap, lorem ipsum in production