Quick answer: A 404 flood — hundreds or thousands of 404 errors generated in a short period — wastes your crawl budget, dilutes your site’s authority signals, and can cause search engines to de-prioritise your healthy pages. The most common causes are bot sweeps, deleted pages with inbound links, and broken redirects.
Let’s start with the thing most articles on this topic get wrong: 404 errors are not a penalty. Google has been consistent about this for years. A page that doesn’t exist should return 404. That’s the correct behaviour, and having some is completely normal for any site that’s been online a while.
So why care about a flood of them?
Because the 404s themselves aren’t the problem. They’re a symptom, and the things they’re symptomatic of will absolutely cost you.
What a spike is actually telling you
When your 404 rate jumps from a handful a day to several hundred an hour, one of a small number of things has happened.
You broke your own internal links
The expensive one. A changed permalink structure, a bulk-edited set of slugs, a deleted category, a migration that didn’t carry redirects across. Now your own navigation, your own internal links, and every external link anyone ever built to those URLs all point at nothing.
This is where real ranking damage lives — not in the 404 status code, but in the fact that pages which had accumulated links and history are simply gone, and the authority those links carried has nowhere to flow.
A bot is probing you
Automated scanners sweep the web looking for known-vulnerable files: old plugin paths, backup archives, exposed config files, admin panels at predictable URLs. Each miss is a 404 in your logs.
Mostly this is background noise every public site receives. But a sudden sustained burst is worth a look — both for what it costs in server resources, and because it tells you someone is actively enumerating your site. The pattern of requested URLs usually makes the intent obvious.
A redirect chain collapsed
Redirect rules accumulate. A plugin update resets them, a rule gets deleted as “unused”, or a chain grows long enough that something in the middle breaks — and traffic that was quietly being routed correctly for years starts hitting a wall.
Something external changed
A partner site relaunched and now links to the wrong path. A newsletter went out with a typo in the URL. A popular post got shared with a mangled link. Real people are trying to reach you and landing nowhere.
The crawl budget question
Crawl budget gets invoked constantly in SEO discussions, usually with more drama than it deserves. Here’s the honest version.
Search engines allocate a finite amount of crawling to each site, based roughly on how large it is, how often it changes, and how quickly your server responds. For a site with a few hundred pages, this is essentially a non-issue — Google can crawl your whole site comfortably regardless of some wasted requests.
Where it starts to matter:
- Large sites — tens of thousands of URLs, ecommerce catalogues, sites with heavy faceted navigation
- Slow servers — if a flood of requests is degrading response times, crawlers back off from your whole site, not just the broken URLs
- Sites publishing frequently — where new content needs to be discovered quickly to be worth publishing
For a typical small business site, the server load and the lost link equity are the real costs. Crawl budget is a secondary concern, and anyone telling you otherwise is probably selling something.
Soft 404s are the genuinely bad ones
A soft 404 is a page that doesn’t exist but returns HTTP 200 anyway — usually a “sorry, nothing found” page served with a success status. Some themes and plugins do this by accident.
These are worse than honest 404s, because search engines have to work out that the page is empty by looking at the content rather than trusting the status code. You end up with thin, near-duplicate pages in the index, all saying nothing.
Google Search Console reports these separately under Pages → Not indexed → Soft 404. If you see a lot, that’s worth fixing before anything else in this article.
What to do when you spot a spike
- Look at which URLs are being requested. This answers almost everything. Recognisable old paths from your own site mean you broke something. Requests for
/wp-content/plugins/some-old-plugin/or/backup.zipmean a scanner. - Redirect what deserves redirecting. If a URL had traffic or inbound links, 301 it to the closest genuine equivalent. Redirect to a relevant page, not blanket-to-homepage — search engines often treat the latter as a soft 404 anyway.
- Leave the rest as 404. Pages that never had value, spam URLs, scanner probes — these should return 404. Don’t redirect them out of tidiness.
- Fix the internal links. If your own menus and content point at dead URLs, no redirect makes that acceptable long-term.
- Check Search Console. The Pages report tells you which broken URLs Google actually cares about, which is a much shorter list than your raw logs.
- Rate-limit persistent scanners. If a single source is hammering you, most security plugins and Cloudflare can throttle it.
Make your 404 page useful
Some 404s are unavoidable, and a real person hitting one is a recoverable situation. A 404 page with your search box, links to your main sections, and a human sentence explaining what happened will save a meaningful share of those visits. The default WordPress 404 page saves almost none of them.
Just make sure it still returns a 404 status code. A helpful 404 page is good; a helpful page pretending to be a successful one is a soft 404.
The monitoring gap
Here’s the practical problem. Search Console reports 404s, but on a delay — often days. Server logs have everything, in a format most people never open. Analytics platforms typically don’t record 404 hits at all unless specifically configured to.
So the usual sequence is: something breaks, weeks pass, traffic dips, and eventually somebody investigates and finds a redirect rule that stopped working in the meantime.
Canary Site Monitor’s 404 flood detection watches the rate rather than the individual errors — a handful a day is normal and stays quiet, while a sudden sustained spike gets flagged along with the top offending URLs. It’s in the free tier, because catching this in hours instead of weeks is most of the value.
404s aren’t a penalty. But a flood of them means something changed on your site that you didn’t intend — and that’s always worth knowing about today rather than next month.