<?xml version="1.0" encoding="UTF-8"?>
<!--
	portal.ozot.com.au — PRODUCTION sitemap.

	Only the two pages a logged-out visitor can actually land on:

	  login.php          the portal entry page
	  reset-password.php the "email me a reset link" form. Renders fine with
	                     no query string; ?message= only adds a status line.

	reset-password-request.php is deliberately NOT here. Despite the name it
	is not a page — it is the POST handler behind the form on
	reset-password.php, and every code path ends in a redirect. Crawled with
	a GET it just bounces to reset-password.php with an error, so listing it
	fed Google a redirect to an error state.

	create-new-password.php is also omitted: it needs a valid selector +
	validator token pair from the reset email, so it is useless to a crawler.

	changefreq is monthly, not daily — these are static screens, and
	overstating it wastes crawl budget better spent on ozot.com.au.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

  <url>
    <loc>https://portal.ozot.com.au/login.php</loc>
    <lastmod>2026-07-13</lastmod>
    <changefreq>monthly</changefreq>
    <priority>1.0</priority>
  </url>

  <url>
    <loc>https://portal.ozot.com.au/reset-password.php</loc>
    <lastmod>2026-07-13</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>

</urlset>
