What a 404 page should do

What a not-found page is for, what it should contain, what it should return to search engines, and how to find out why visitors are reaching it.

3 minread 759words last updated

The short answer

A not-found page is what a visitor sees when they reach an address that does not exist: a mistyped link, an old bookmark, a page you removed, a link someone else got wrong. Its job is to turn that dead end into a next step. It says plainly that the page could not be found, offers the most useful routes onward, a search box or the main sections, a link home and a way to contact you, and does so in the site’s own design and speed. Technically it must return the real not-found status to the browser, so that search engines remove the missing address from their index rather than treating an error page as content. And the visits it receives are information: every one is a broken link, an address that should have had a redirect, or a typo, and a monthly look at the log tells you which links to fix and which redirects to add.

What a good not-found page contains

ElementWhy
A plain statement that the page was not foundThe visitor should understand in a second
One or two likely reasonsMoved, removed, or a mistyped address
A search box, where the site has searchThe fastest route to what they wanted
The main sections or most-visited pagesThe second fastest route
A link to the home pageThe universal fallback
A way to contact youFor the visitor who was looking for exactly this
The site’s normal header and footerOrientation and trust
The real not-found status codeSo search engines and tools understand
SpeedIt should load as fast as any other page

Setting it up

  1. Design the page in the site’s system with the elements above.
  2. Return the not-found status for any address that does not exist; verify with a tool, not by looking.
  3. Log not-found requests with the requested address and the referrer.
  4. Review the log monthly; add redirects for old addresses with real destinations, fix your own broken links, contact sites linking to wrong addresses where it matters.
  5. Check the search console for the crawler’s list of not-found addresses and reconcile.
  6. Test the page on a phone, and test that the site’s search works from it.

What the log tells you

Recurring addresses from your own domain as referrer are broken internal links to fix today. Recurring addresses from other domains are external links worth a redirect, because they carry visitors and sometimes ranking. Addresses that match the old site’s structure are redirects missed during a migration. Odd addresses with no referrer are usually scanners probing for admin pages and backups, which is information for the security side. A monthly ten minutes with the log turns the not-found page into a maintenance tool.

What this means for you

Give your site a not-found page that states the problem plainly, offers search and the main routes, returns the real not-found status and is logged. Review the log monthly and fix what it shows. It turns dead ends into next steps for visitors, keeps search engines accurate, and quietly reports every broken link pointing at your business.

Written by the CivSec S.M.A.R.T team

We build and run websites, software and AI systems for businesses. We write about what we see in that work, in plain language, and we update articles when things change.

Last checked . Spotted something outdated? Tell us.

Frequently asked questions

Should the 404 page redirect to the home page instead?

No. A redirect hides the problem from the visitor, who wanted a specific page and now has the home page without explanation, and from you, because the broken link never appears in a log. It also confuses search engines, which see a missing page pretending to exist. Show a proper not-found page, and if the old address had a real destination, add a specific redirect for it.

What should the page say?

That the page could not be found, in one sentence; the most likely reasons, briefly; and what to do next: a search box or the main sections, a link to the home page and a way to contact you. If the address looks like an old pattern you recognise, a targeted suggestion helps. Design and tone should match the site; a light touch is fine, an elaborate joke that delays the next step is not.

How do we find out why people hit it?

Log every not-found request with the address requested and where the visitor came from, and review the log monthly. Addresses that recur are broken links somewhere, on your own site, on other sites or in old marketing, and each one is fixed with a redirect or by correcting the link. The search console reports the same from the crawler's perspective.

Sources

  1. Google Search Central: HTTP status codes, network and DNS errors (accessed 2026-09-12)