These are the pages nobody visits on purpose, which is exactly why they're easy to forget — and exactly why their absence becomes a problem the first time someone follows an old bookmark, a broken link, or looks for a privacy policy before trusting a form with their email address.
Custom 404 checklist
- A branded 404 page exists, matching the site's actual design rather than the hosting platform's generic default error page.
- The 404 page includes clear navigation back into the site — a link to the homepage at minimum, ideally also a search box or links to popular pages.
- The page returns a real HTTP 404 status code in the server response, not a 200 status with 404-looking content (a "soft 404") — this distinction matters for how search engines interpret the page.
- The 404 page is tested by visiting a deliberately broken URL, not just previewed in a page builder.
Redirects checklist
- Every URL from a previous version of the site (or a prior domain, if one is being retired) is mapped to its closest equivalent new URL — not just left to 404.
- Redirects are implemented as 301 (permanent), not 302 (temporary), so search engines transfer ranking signals to the new URL correctly.
- Redirect chains are flattened — a redirects to b redirects to c should become a single redirect straight to c, both for speed and to avoid signal loss across multiple hops.
- Redirects are spot-checked after launch, not just configured and assumed correct.
Legal pages checklist
- A privacy policy exists, describing what data is collected (including via analytics and forms) and how it's used.
- Terms of service exist, particularly if the site processes payments, collects user accounts, or offers any kind of service agreement.
- A cookie consent mechanism is in place if the site uses cookies for analytics or advertising and serves visitors from regions with consent requirements — the EU's requirements and various US state-level laws differ in specifics but both are real compliance considerations, not optional extras.
- Contact information on legal pages matches the actual business — a mismatched or outdated business name/address on a privacy policy is a common, easily-avoided credibility gap.
| Item | Why It's Often Skipped | Real Risk |
|---|---|---|
| Custom 404 page | No one browses to a broken link on purpose during testing | Visitors from old links or typos hit a dead end with no way back into the site |
| Complete redirect map | Only top-traffic pages get redirected, long-tail ones forgotten | Lost backlinks and rankings tied to those forgotten URLs |
| Privacy policy / terms | Feels like paperwork rather than "real" launch work | Legal exposure and reduced visitor trust, especially before a form submission |
| Cookie consent | Easy to overlook for a small or regional-feeling business | Non-compliance risk for EU/US visitors regardless of company size |
None of these items are complicated individually, but together they're the difference between a site that feels finished and one that quietly has loose ends. Redirects specifically deserve extra care any time a site undergoes a bigger structural change later — see the full technical SEO checklist for site migrations for that deeper scenario.
FAQ
Does a custom 404 page need to return a real 404 status code?
Yes — a branded 404 page still needs to return an actual HTTP 404 status in its server response, not a 200 (success) status with 404-looking content. A 200 status on a missing page is called a "soft 404" and can confuse search engines into treating a broken page as valid content.
- Check this with a header-inspection tool, not just by looking at the page visually — the visual design and the status code are configured separately.
- Soft 404s can also pollute analytics data by counting broken-link visits as valid pageviews.
Which legal pages does a small business website actually need?
At minimum a privacy policy and terms of service, and a cookie consent banner if the site uses cookies for analytics or advertising and serves visitors from regions with consent requirements — the US and EU specifically have differing but real requirements, and having none of these pages is a bigger practical risk than most small sites assume.
- Even a simple, small-business-appropriate privacy policy is better than none, and templates are a reasonable starting point for very small sites.
- Contact details on these pages should match the real business — an outdated or generic placeholder is a small but noticeable credibility gap for visitors who check.