Set up and work through the 404 log
What is recorded
If WordPress finds while building a page that there is nothing for the request (status 404), the log writes a line. It contains: the requested path, the number of views so far, first and last occurrence as well as the referrer last seen. There is exactly one line per address — if the same address comes up again, only the counter is increased and the time is updated. Not stored are IP address, browser identifier and user name. Also not ending up in the log: requests to /wp-admin, /wp-login.php, /wp-cron.php, /xmlrpc.php, /wp-content, /wp-includes, /wp-trackback.php and the REST interface, plus favicon.ico and apple-touch-icon as well as everything that does not come in via GET or HEAD. Views of the home page are passed over.
Switching on and setting the retention period
The “404 log” (in German: „404-Protokoll“) area has two settings. The “Log 404s” switch controls the recording; if it is off, nothing more is written down — but the existing stock stays. Below it you enter the retention period in days: 0 means unlimited, values up to 3650 are allowed. As soon as you save a value greater than 0, a daily cleanup job is registered that runs for the first time an hour later; if you set it back to 0, it is deregistered. The scheduled time appears as a status line directly below the field — if it says “not scheduled”, retention is unlimited. The cleanup only deletes rows without an associated redirect.
Reading the list
The table shows address, hits, first, last and referrer, 50 rows per page. Using the two buttons in the card header you sort by frequency or by time: frequency shows what permanently leads nowhere, time shows what has just been added — handy right after a move or a change of the permalinks. For the referrer, “direct” means that the browser did not send one (bookmark, typed by hand, mail program). An entry marked “internal” comes from your own website — then a link in your own content leads nowhere, and you should correct the source instead of only redirecting. The three key figures at the top name the number of distinct addresses, the sum of all views and how many addresses do not have a redirect yet.
Turning a row into a redirect
Every row without a rule has the button “Create redirect”. In the dialog you state the target — a path such as /neue-seite or a complete address with https:// — and choose the type: 301 permanent, 302 temporary, 307 temporary with the method preserved, 308 permanent with the method preserved, or 410 if the page is deliberately gone and gets no target at all. As a note it is recorded automatically which log entry the rule comes from and how many hits it had at that time. After that the row carries the marking “redirected”; such rows are kept during every cleanup so that the origin remains traceable. The operation is declined if source and target are the same address, if there is already a rule for the path, or if the chain leads back to the source via existing rules.
Space, cleanup and what you have to do yourself
Regardless of the retention period, the cap is 1000 rows. If it is exceeded, whatever has not occurred for the longest time drops out first — rows with a redirect in place never do. Address and referrer are cut off at 190 characters, so very long attack addresses appear shortened in the list. You remove single rows with “Remove”, the entire set with “Clear log”. Expect part of the entries to come from programs that try out addresses — a redirect is not worth it for those. The list is useful above all for addresses with many hits, for entries with an internal referrer and for everything that turns up shortly after a change. There is no notification: look in regularly during the first weeks after a move.