Discoverability · 30 points
Unknown URLs 404
One check, stated three ways: what we measure, what would make it wrong, and how to confirm it yourself.
What this measures
Fetches a random path on the same origin that no page should own and reads the status code. 404 or 410 passes; a 200 means the server answers every address, and a redirect means it funnels typos somewhere.
Where this check can be wrong
Bot protection that answers 403 or 429 to the probe is treated as unmeasurable, not as failure, because that response is about us rather than about the site. A site that redirects unknown paths to a helpful search page is deliberately marked down here even though a human might prefer it.
Verify it without taking our word for it
Open https://your.site/this-page-should-not-exist and look at the status code in DevTools → Network, not at the page that renders.