no404 – Auto 404 Redirect

When you delete a product, change a permalink or migrate a site, the old URLs keep getting traffic. Visitors land on an empty 404 page, and the traffic and the signals those old links carry go nowhere.

Most redirect plugins ask you to fix this by hand: you write a rule for every broken URL. That does not scale past a few dozen.

no404 works the other way around. It keeps a synchronised index of the URLs your site actually has, and when a request 404s it finds the closest match in that index automatically. You write no rules.

How it is different

• No manual rules. Other plugins need /old-url → /new-url written out one at a time. no404 matches against your live catalogue, so a deleted product URL finds its closest surviving equivalent on its own.
• A real 301, server side. JavaScript based solutions leave the HTTP status at 404, so Google still sees a dead page and bots that do not run JavaScript are never redirected. This plugin redirects before any HTML is sent.
• It defers to your existing setup. no404 runs late on template_redirect, so Yoast SEO, Rank Math and Redirection get to act first. It is a last resort, not a competitor to your redirect table.

Your site never waits

If the service is slow or unreachable, the plugin steps aside and your theme’s own 404 page renders normally. Requests time out after 1.5 seconds, and after a failure the plugin stops calling out entirely for a short while instead of adding that delay to every 404.

301 or 302?

You decide, in your no404 dashboard (site Settings → “Permanent (301) or temporary (302)?”). Because 301s may be cached aggressively by browsers and search engines and can be hard to reverse quickly, the default is cautious:

• Redirects you defined by hand in your no404 dashboard → 301
• Catalogue matches at or above your 301 threshold (0.5 by default; you can pick 0.7, 0.35, a custom value, or “only manual redirects get a 301”) → 301
• Lower confidence matches and fallbacks → 302

The no404 API sends this decision with every result and the plugin follows it, so changing the setting needs no plugin update. You can still force everything to 301 in the plugin settings, but it is off by default.

Quota friendly by design

Results are cached locally for an hour, including “no match found”. A bot hammering the same dead URL two hundred times a day costs you one lookup, not two hundred. Static files (.css, .js, .png and so on) and admin paths such as /wp-admin and /wp-json are never sent to the service at all.

WooCommerce

Deleted product URLs are the main thing this plugin was built for. It does not interfere with WooCommerce permalink structures.

Account required

The matching engine runs as a hosted service, so the plugin needs a free no404 account and an API key. The free plan covers 1,000 lookups per month. See the External services section below for exactly what is transmitted.

Languages

The plugin is written in English and ships with translations for Turkish, German, French, Spanish, Russian, Hindi and Arabic (right-to-left). It follows the language of your WordPress installation, so there is nothing to configure.

External services

This plugin relies on the no404 service to work out where a broken URL should be redirected. The matching is done remotely, against an index of your site built from your sitemap, so the plugin cannot perform it on its own.

When data is sent

A request is sent when a visitor hits a 404 page, and only then. Requests are not sent when:

• the result for that path is already in the local cache (one hour by default); visits from an ad or an AI assistant are always looked up so they are counted,
• the path is a static file or an administrative path (see the exclusion list in the settings),
• the request is not a GET or HEAD request,
• the service recently failed or the request limit was reached.

Two more requests are made only when you ask for them in the admin: the connection test (a lookup like any other, listed in your dashboard) and, when you connect the plugin in the setup wizard, a check of which no404 site the API key belongs to. That check sends only the API key, is not recorded as a 404 and does not use quota.

The setup wizard’s “Create a free account” button opens no404’s sign-up page with your site’s domain in the address, so the right site is preselected there. Nothing is sent until you click it.

What is sent

• The path that returned 404, for example /old-product. Query strings are stripped before sending.
• The referring URL, taken from the HTTP Referer header, when the browser supplies one.
• When the visit came from an ad, the ad network as a single word (google, microsoft, meta or other), worked out on your server from the click ID or a paid utm_medium. The click ID itself is not sent.
• When the visitor came from an AI assistant, the assistant as a single word (chatgpt, claude, perplexity, gemini, copilot, meta or other), worked out on your server from the utm_source parameter or the referring site. The utm_source value itself is not sent.
• The visitor’s IP address truncated to its network: the last part of an IPv4 address is set to zero (203.0.113.45 becomes 203.0.113.0), and only the first 48 bits of an IPv6 address are kept. Private and local addresses are not sent. This is what lets your dashboard tell bots from people and group requests by network.
• A pseudonymous visitor ID: a keyed hash (HMAC-SHA256) of the visitor’s IP address, computed on your server with a secret derived from your site’s own security keys. no404 never receives the secret, so it cannot turn the ID back into an address or recognise the same visitor on another site. It only lets your dashboard count unique visitors.
• The visitor’s browser user agent (for example Mozilla/5.0 (iPhone; …)), used to classify the request as a bot or a browser and by device type.
• The visitor’s country code, only when your site is behind Cloudflare and it supplies one (CF-IPCountry).
• Your site’s home URL and the plugin version, sent in the User-Agent header to identify the installation.
• Your API key, which identifies your account.

What is not sent

The plugin never transmits the visitor’s full IP address, cookies, session data, form contents, the query string or click IDs. Developers can change or remove the visitor data with the no404_visitor filter.

Service provider

The service is operated by no404, https://no404.tr

• Terms of Service: https://no404.tr/terms
• Privacy Policy: https://no404.tr/privacy