The site answered «all good» to addresses that do not exist. And Google put them in first position.
Until 25 September 2026 Itria's site answered «all good» to addresses that never existed. Five of them were getting impressions on Google in first position.
Without a 404 page, Cloudflare Pages answers everything. Cloudflare's documentation says that, if the project has no 404.html file at the root, Pages treats it as a single-page application and sends every address to the root. On itria.io a non-existent address answered with the home page and code 200.
Five addresses never created were in Search Console. In the 28 days up to 25 September 2026 they got 7 impressions and 1 click, all in position 1. They were garbled variants of real addresses, served as copies of the home page.
Who generated them cannot be seen in the data. They are addresses rebuilt from memory, and the most likely hypothesis is an AI assistant citing a page without copying its link. It is an inference, not a measurement, and we write it that way.
This is a piece of Itria's lab: things measured on our own site, with the real numbers, to understand how search engines and assistants read it. The service that grows out of it is presence on search engines and AI assistants.
What happens to a site on Cloudflare Pages without a 404.html
A static site on Cloudflare Pages without a 404.html file at the root answers any address with the main page. Cloudflare's documentation explains it this way: without that file, Pages assumes the project is a single-page application and matches every path to the root.
«If your project does not include a top-level 404.html file, Pages assumes that you are deploying a single-page application.» (Cloudflare, Pages documentation, «Serving Pages»)
For a single-page application it is the right behaviour. For a site made of real pages it is an invisible defect: whoever opens a wrong address sees the home page, with no error, and the server answers 200, that is «page found». On 25 September 2026 we measured it on our own site, in the hygiene audit.
The five phantom addresses
In the 28 days up to 25 September 2026, Search Console recorded five itria.io addresses that we never created. All in position 1, all served as a copy of the home page. Added up they make 7 impressions and 1 click: small numbers, but five pages that existed for Google and not for us.
| Phantom address | Impressions and clicks, 28 days | Closest real page |
|---|---|---|
| /modello-scheda-prodotto-alimentare | 3 impressions, 1 click, position 1 | /modello-scheda-tecnica-prodotto-alimentare |
| /modelo-scheda-tecnica-prodotto-alimentare | 1 impression, position 1 | /modello-scheda-tecnica-prodotto-alimentare |
| /esportare-alimenti-emirati | 1 impression, position 1 | /esportare-alimentari-emirati |
| /ai-act-gdpr | 1 impression, position 1 | /ai-act-e-gdpr |
| /richiesta-certificato-esportazione | 1 impression, position 1 | /richiesta-certificato-sanitario-esportazione |
Where they come from: an inference, not a measurement
Search Console says that an address got impressions, not who wrote it. The five look like an address rebuilt from memory: a skipped word, «alimenti» instead of «alimentari», «modelo» instead of «modello», a missing «e». It is the kind of mistake made by someone who cites a page without copying its link.
An AI assistant that answers citing a source from memory produces exactly this kind of address. That is why we think it is the most likely origin. But Search Console data does not prove it, and with 7 impressions no data would: it remains a hypothesis, and we keep it as one.
What we did: a real 404 and five redirects
The fix has two parts. A 404.html page at the root, excluded from the index, that leads to services, articles and the Diagnostico: from that moment a non-existent address answers 404. And a permanent redirect, code 301, from the five phantom addresses to the closest real page, plus a rule for the whole «esportare-alimenti» family.
Measured on the evening of 25 September 2026: a made-up address answers 404; /ai-act-gdpr, /modello-scheda-prodotto-alimentare and /esportare-alimenti-cina answer 301 to the right pages. Whoever arrives from a wrong link finds the page they were looking for, and Google stops counting copies of the home page.
The five-minute check, on your site
The check takes one command and one search. You ask the site for an address that does not exist and look at the code it answers with: it must be 404, not 200. Then, in Search Console, you scroll the list of pages with impressions looking for addresses you never created.
curl -s -o /dev/null -w "%{http_code}\n" https://yoursite.com/address-that-does-not-exist If the command prints 200, the site answers «page found» even where there is nothing. On Cloudflare Pages the cure is a 404.html file at the root; on other services the name changes, the principle does not. Phantom addresses that already have impressions are sent with a 301 to the closest real page.
Questions and answers
What happens to a site on Cloudflare Pages without a 404.html file?
It answers any address with the main page. Cloudflare's documentation says that, without a 404.html at the root, Pages treats the project as a single-page application and matches every path to the root.
On itria.io, until 25 September 2026, a non-existent address answered with the home page and code 200.
Why can an address that does not exist get impressions on Google?
Because the server answers 200 with a real page, usually the home page, and Google treats it as an existing page. On itria.io five addresses that were never created got 7 impressions and 1 click in 28 days, all in position 1.
Since the site has a real 404 and the 301 redirects, made-up addresses answer 404 and the phantom ones lead to the right page.
Are phantom addresses generated by AI assistants?
Probably, but it is an inference. The five itria.io addresses look like links rebuilt from memory, with skipped or garbled words, which is the kind of mistake made by someone who cites a page without copying its link.
Search Console says that an address got impressions, not who wrote it: the data does not prove it.
How do you check whether your site answers 200 to non-existent pages?
You ask the site for an address that does not exist, for example with curl, and look at the response code: it must be 404. If it is 200, the site answers page found even where there is nothing.
Then in Search Console you look, among the pages with impressions, for addresses you never created.
How do you fix phantom addresses?
With a real 404 page, which on Cloudflare Pages is a 404.html file at the root, and with a permanent 301 redirect from each phantom address to the closest real page.
That way whoever arrives from a wrong link finds the page they were looking for, and Google stops counting copies of the home page.
Notes on sources
- Cloudflare, Pages documentation, «Serving Pages»: the behaviour without a 404.html at the root. The quotation in quotation marks is taken verbatim.
- Search Console of itria.io, export of the pages over the 28 days up to 25 September 2026: impressions, clicks and position of the five addresses.
- Itria's measurements: hygiene audit of 25 September 2026 (200 response with the home page) and check on the evening of the same day (404 on made-up addresses, 301 on the five phantom ones).
- The origin of the phantom addresses is an inference by Itria, not a measurement: Search Console does not record who wrote a link.
Seeing your own site the way search engines and assistants read it.
An address that answers 200 where there is nothing, an email address that is not in the code: these are defects you cannot see from the browser. Write us a line about what weighs on you: we take the first step, even if we end up not working together.