The default 404 is a white page with a server name and version on it. It loses the visitor, and it hands anybody scanning your site a precise version number to look up. Your own page keeps people on the site and says nothing it should not.

Nginx

error_page 404 /404.html;\nerror_page 500 502 503 504 /50x.html;\n\nlocation = /404.html { root /var/www/site/public; internal; }\nlocation = /50x.html { root /var/www/site/public; internal; }\n\nserver_tokens off;

internal means the page can only be reached as an error, not by typing its address. server_tokens off removes the version from every response and every error page.

Apache and LiteSpeed

ErrorDocument 404 /404.html\nErrorDocument 500 /50x.html\nServerSignature Off

What the page should contain

  • A plain sentence saying what happened, without a stack trace.
  • A link to the home page and to search.
  • The same header and footer as the rest of the site, so it does not feel like a dead end.
  • Nothing loaded from a path that might also be broken - inline the CSS if you can.
A 404 page must return status 404, not 200. A soft 404 - a friendly page with a success status - makes every mistyped address look like real content, and search engines will index all of them.
curl -sSI https://yourdomain.com/no-such-page | head -1\n# HTTP/2 404

The 500 page is different

It is shown when the application is broken, so it must not depend on the application. Keep it as a static file the web server can serve on its own.