A 404 page usually gets treated like the internet equivalent of a “my bad”. It’s a little annoying at times, and, if it’s a common issue on a site, may act as a deterrent to return visits. But, for the most part (as average internet users) we just do the surfing equivalent of a u-turn, then we move on.
But does everyone?
A lot of people don’t realise, but a forgotten 404 can reveal quite a bit of information about how a website is structured, like which services have been retired, and whether old subdomains or external services are still connected behind the scenes. Sometimes the page itself is harmless but the problem lies in what it points towards.
What a 404 can reveal
Even after a page has disappeared, its URL can stick around in search results, old documents, emails, social posts, or third-party systems. There is a trail of bread crumbs that isn’t dusted away just because the gingerbread house is gone.
Old subdomains are particularly interesting because a company might have once used ‘events.example.com’, ‘help.example.com’, or ‘campaign.example.com’, then quietly moved the content somewhere else. The DNS record can remain long after the project has been forgotten.
That’s where things get uncomfortable: if the subdomain still points towards an external platform, cloud service, hosting provider, or application that the organisation no longer controls, an attacker might be able to register the abandoned resource and serve their own content with your name still attached to it.
The trust you’ve built with customers and the web algorithms is doing a lot of heavy lifting not just for someone else, but for someone who has bad intentions.
The forgotten-subdomain problem
DNS records gather ‘dust’ just as easily as a stack of old paper files. Subdomain takeover can start with an old campaign, a discontinued app, or a developer experiment that nobody remembered to clean up, not some dramatic breach of the main website.
Under someone else’s control, the consequences range from phishing pages and malicious redirects to cookie theft attempts and damage to the organisation’s reputation.
And because the address bar still looks legitimate, the social-engineering part becomes considerably easier.
Your 404 monitoring needs to go further
Checking whether a page returns a 404 isn’t a comprehensive review, since checking only tells you that the requested resource isn’t there and not why the URL exists. You also can’t glean what used to sit behind it, or whether its DNS configuration has been left dangling.
If you’re auditing your infrastructure, you need to know how to avoid subdomain takeover and understand how these abandoned references can become exploitable. A proper review should include old subdomains, DNS records, external service dependencies, expired projects, and assets belonging to previous campaigns.
Clean up the digital leftovers
Start with a current inventory of your subdomains. Compare it against DNS records, cloud services, SaaS platforms, and internal documentation, then remove records for services that have been decommissioned, verify ownership of anything hosted externally, and keep an eye on old campaign domains before they become somebody else’s problem. It’s good hygiene for any business with an online presence.
That forgotten 404 might still be telling you something that you need to listen to.