Short answer: A pre-launch pass needs three things: a branded 404 page that returns a real HTTP 404 status rather than a "200" soft 404, a complete 301 redirect map from every old URL to its closest new equivalent with chains flattened to one hop, and at minimum a privacy policy and terms of service — plus a cookie consent mechanism if the site serves EU or US visitors and uses cookies for analytics or ads.
These are the pages nobody visits on purpose, which is exactly why they're easy to forget — and exactly why their absence becomes a problem the first time someone follows an old bookmark, a broken link, or looks for a privacy policy before trusting a form with their email address.
Custom 404 checklist
- A branded 404 page exists, matching the site's actual design rather than the hosting platform's generic default error page.
- The 404 page includes clear navigation back into the site — a link to the homepage at minimum, ideally also a search box or links to popular pages.
- The page returns a real HTTP 404 status code in the server response, not a 200 status with 404-looking content (a "soft 404") — this distinction matters for how search engines interpret the page.
- The 404 page is tested by visiting a deliberately broken URL, not just previewed in a page builder.
Redirects checklist
- Every URL from a previous version of the site (or a prior domain, if one is being retired) is mapped to its closest equivalent new URL — not just left to 404.
- Redirects are implemented as 301 (permanent), not 302 (temporary), so search engines transfer ranking signals to the new URL correctly.
- Redirect chains are flattened — a redirects to b redirects to c should become a single redirect straight to c, both for speed and to avoid signal loss across multiple hops.
- Redirects are spot-checked after launch, not just configured and assumed correct.
Legal pages checklist
- A privacy policy exists, describing what data is collected (including via analytics and forms) and how it's used.
- Terms of service exist, particularly if the site processes payments, collects user accounts, or offers any kind of service agreement.
- A cookie consent mechanism is in place if the site uses cookies for analytics or advertising and serves visitors from regions with consent requirements — the EU's requirements and various US state-level laws differ in specifics but both are real compliance considerations, not optional extras.
- Contact information on legal pages matches the actual business — a mismatched or outdated business name/address on a privacy policy is a common, easily-avoided credibility gap.
| Item | Why It's Often Skipped | Real Risk |
|---|---|---|
| Custom 404 page | No one browses to a broken link on purpose during testing | Visitors from old links or typos hit a dead end with no way back into the site |
| Complete redirect map | Only top-traffic pages get redirected, long-tail ones forgotten | Lost backlinks and rankings tied to those forgotten URLs |
| Privacy policy / terms | Feels like paperwork rather than "real" launch work | Legal exposure and reduced visitor trust, especially before a form submission |
| Cookie consent | Easy to overlook for a small or regional-feeling business | Non-compliance risk for EU/US visitors regardless of company size |
None of these items are complicated individually, but together they're the difference between a site that feels finished and one that quietly has loose ends. Redirects specifically deserve extra care any time a site undergoes a bigger structural change later — see the full technical SEO checklist for site migrations for that deeper scenario.
FAQ
Does a custom 404 page need to return a real 404 status code?
Yes — a branded 404 page still needs to return an actual HTTP 404 status in its server response, not a 200 (success) status with 404-looking content. A 200 status on a missing page is called a "soft 404" and can confuse search engines into treating a broken page as valid content.
- Check this with a header-inspection tool, not just by looking at the page visually — the visual design and the status code are configured separately.
- Soft 404s can also pollute analytics data by counting broken-link visits as valid pageviews.
Which legal pages does a small business website actually need?
At minimum a privacy policy and terms of service, and a cookie consent banner if the site uses cookies for analytics or advertising and serves visitors from regions with consent requirements — the US and EU specifically have differing but real requirements, and having none of these pages is a bigger practical risk than most small sites assume.
- Even a simple, small-business-appropriate privacy policy is better than none, and templates are a reasonable starting point for very small sites.
- Contact details on these pages should match the real business — an outdated or generic placeholder is a small but noticeable credibility gap for visitors who check.