Free tools Windows power users keep installed
One-click scans. No signup required.
A soft 404 can make a missing route look successful to a web scanner: the server returns HTTP 200 even though the page says it is unavailable, is empty, or has failed to render. Whether that confuses a DAST scan depends on the scanner’s crawl and file-not-found detection. To diagnose a suspected gap, compare a known-good route with a deliberately nonexistent one, then check whether the scanner reached the pages you expected.
What a soft 404 is—and why a DAST scanner may care
A soft 404 is a page that behaves like a not-found or error page but returns HTTP 200, or a page that renders empty or nearly empty. Google Search Central describes the familiar case as a URL that tells users the page does not exist while returning a success status. Its examples of possible causes include an empty internal-search result, a database connection failure, a missing server-side include, or missing JavaScript. Google Search Central’s troubleshooting guidance explains these cases in the context of search crawling, not DAST performance.
As an Amazon Associate I earn from qualifying purchases.
DAST tools commonly discover an application’s surface by crawling pages and use captured requests for subsequent checks. If a missing route produces a generic 200 page, a scanner’s own response interpretation may affect whether it treats that route as content or as not found. This is a scanner-specific risk, not proof that every DAST tool will fail or that a soft 404 automatically hides vulnerabilities. For example, OpenText documents configurable file-not-found detection in Fortify WebInspect; other tools may use different mechanisms.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow to tell a soft 404 from a crawl or access gap
Test two routes: one that should exist and one that should not. Request each directly and record the status code, redirect chain, content type, and a representative excerpt of the response body. If the application relies on JavaScript, also check what the browser renders. A 200 paired with a “not found” message, an empty page, or an error-like result is a signal to investigate—not by itself a diagnosis of why a scan missed a page.
#1 Best Overall
Then look at the scanner’s crawl-path output and diagnostic logs. Did it request the route at all? If not, response classification may not be the issue. Check whether the crawler was authenticated, whether the target host and route were in scope, and whether the route was discoverable through links, a sitemap, or an explicit target-path option. A logged-out crawler or an out-of-scope host can prevent a page from being reached before response handling matters.
Which part of the scan should you fix?
| What the test shows | Likely next step | What to verify |
|---|---|---|
| A removed route returns 200 with a not-found or error-like page. | Correct the application response, or configure the scanner’s documented file-not-found behavior if an application change is not immediately possible. | That the missing route is recognized as missing and a known-valid route is still treated as valid. |
| A route that should work is empty, broken, or showing an error. | Investigate rendering, missing resources, JavaScript, or the underlying server-side failure. | That the page loads correctly in the browser and is reachable by the scanner. |
| The scanner never requests the expected route. | Review authentication, scope, target paths, sitemap use, cache behavior, and crawl limits. | That the route appears in the crawl output and the scan reaches it under the intended access conditions. |
Configure file-not-found detection to match the application
Some scanners let you define which response status codes indicate a missing file, supply a custom response signature, or use automatic detection for servers that return 200 alongside a missing-file message. OpenText’s Fortify WebInspect 25.4.0 file-not-found settings document those product-specific options. Consult the documentation for the scanner and version you actually use; do not assume the same setting or detection method exists in every DAST product.
Base any status-code rule or signature on the responses you observed. A rule that matches a generic message too broadly can misclassify legitimate pages as missing; one that does not match the application’s actual error response may leave the ambiguity unresolved. After changing a setting, test it against both your known-valid route and your deliberately nonexistent route.
Correct the application response for the page’s actual state
- The content is gone and has no replacement: Return HTTP 404 or 410 rather than a successful response carrying a not-found message.
- The content has moved to a clear replacement: Redirect to that destination with a permanent 301.
- The page should still be available: Investigate the rendering failure, missing resources, or prominent error message rather than labeling the route as missing.
These response choices follow Google Search Central’s guidance for removed, moved, and still-existing content. They also make the route’s status clearer to users and systems that rely on HTTP semantics.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify crawl coverage and scan safety before trusting a clean report
For GitLab’s browser-based DAST analyzer, the documentation describes crawl-path diagnostic logs, sitemap and explicit target-path options, cache troubleshooting, scope allowlisting, and crawl limits. It documents default limits of 10,000 actions or 24 hours; these are GitLab-specific settings, not general DAST limits, and should be checked against the documentation for the version in use. A crawl that hits a limit may not have completed the coverage you expected.
Check the scan’s authentication and scope as well as its discovered URL list and completion status. OWASP’s DevSecOps guidance on Dynamic Application Security Testing notes that DAST may miss code paths it does not reach and that authenticated or stateful flows need explicit configuration.
Rank #4
Run active scans in a test or isolated environment. GitLab warns, “Do not run DAST scans against a production server,” because its browser-based analyzer can click controls and submit forms, potentially modifying data or triggering bugs. The warning is product guidance, and the safety principle applies when an active scan could alter application state.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Choose one known-valid route and one deliberately nonexistent route; compare their status codes, redirects, response bodies, and browser-rendered results.
- Use scanner logs and discovered-path output to determine whether the intended routes were reached.
- Check authentication, scope, and any product-specific crawl or time limits.
- Fix incorrect application responses, rendering problems, or access and crawl configuration; tune file-not-found detection only as the selected scanner documents it.
- Rerun the scan in an isolated environment, then confirm the expected routes appear in the crawl output and the scan completed.
A completed report describes the surface the tool actually reached under its configured authentication and scope. It does not establish that every application path was tested.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
