<?xml version="1.0" encoding="UTF-8"?>
<!--
  Williams Candy — sitemap.
  Every URL below is production-absolute on purpose. Keep it that way:
  a relative <loc> is invalid in a sitemap, and absolute URLs are what
  makes this file correct no matter which host serves it.

  The staging host this note used to name was retired at cutover and no
  longer resolves. Every <loc> below is on williamscandy.com, which is
  the production domain and the only host that serves this file.
  assets/config.js PROD_HOSTS is the record of which hostnames are
  ours; nothing but the production one belongs in a sitemap.

  Only indexable pages belong here. Deliberately excluded:
    /offline.html  PWA fallback, <meta name="robots" content="noindex">
    /order/        Disallow in robots.txt, noindex at the page level
    /qr/           Disallow in robots.txt, noindex response header
    /docs/ /tools/ /qa/   403 via .htaccess
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://williamscandy.com/</loc>
    <lastmod>2026-08-12</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://williamscandy.com/menu.html</loc>
    <lastmod>2026-08-12</lastmod>
    <changefreq>weekly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://williamscandy.com/wholesale.html</loc>
    <lastmod>2026-08-12</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://williamscandy.com/gifts.html</loc>
    <lastmod>2026-08-15</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://williamscandy.com/privacy.php</loc>
    <lastmod>2026-08-12</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://williamscandy.com/terms.php</loc>
    <lastmod>2026-08-12</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
</urlset>
