LAB REPORT / 006

Cloudflare Pages soft 404: when missing URLs return 200

A production routing experiment: reproduce false 200s on missing URLs, deploy a narrow allowlist, and verify real 404 responses.

Verdict: Fixed in production for tested routes; no ranking uplift claimed.

Question and answer

Can Cloudflare Pages serve a homepage with HTTP 200 at nonexistent URLs?

Yes. At about 05:57 UTC on October 9, two nonexistent production URLs returned 200. After deploying a route allowlist in commit d1069a0, production checks confirmed 404 on unknown paths and 200 on published Experiment 005. This shows a soft-404 risk, not a Google Search Console classification.

Observed measurements

  • 200 — before: missing paths
  • 404 — after: missing paths
  • 7/7 — route tests passed
  • 15 — sitemap URLs checked at fix time

Procedure

  1. Reproduce the production response: Before the fix, /en/this-is-an-unknown-route/ and /xyzzy-unknown/ returned 200 in direct HTTP checks. An earlier browser visit to /en/not-a-real-page/ rendered the homepage.
  2. Constrain the Pages SPA fallback: Allow only the three localized homepages, published experiments, feeds and static assets. Keep the root language redirect; return HTTP 404 and X-Robots-Tag: noindex for all other paths.
  3. Test and verify the deployed fix: Seven Node middleware tests passed, covering all 15 published sitemap URLs, redirects and discovery files. Typecheck and build passed. Cloudflare deployed d1069a0; subsequent production HTTP checks found real 404s while Experiment 005 stayed 200.

Findings

A visible homepage can mask a wrong HTTP status

Client-side rendering can make nonexistent routes look healthy. Crawlers still receive the server status; missing content must not be a successful response.

The sitemap and allowlist must stay synchronized

An allowlist fixes the fallback but can accidentally block a newly published article. Regression tests now check sitemap URLs against the middleware.

Failure modes

The first patch covered too few unknown paths

Blocking unpublished experiment IDs and known probes did not prevent arbitrary missing routes from falling through to the homepage.

No indexing or traffic outcome measured

Search Console classification was unavailable. HTTP correctness is verified, but indexing, ranking and organic referral improvements are not.

Evidence and limits

Pre-fix check
2026-10-09 ~05:57 UTC
Tested missing URLs
/en/this-is-an-unknown-route/ ; /xyzzy-unknown/
Before / after
HTTP 200 → HTTP 404
Production fix
d1069a0
Published report control
/en/experiments/exp-005/ : HTTP 200
Regression checks
7/7 PASS; 15 sitemap URLs
Search Console classification
Unavailable; no soft-404 classification asserted

Related reports

EXP-005

Back to lab reports