Why 404s happen
- A page was deleted or its address changed without a redirect. The most common cause after a redesign; see what a 301 redirect is.
- A link on your site, or on someone else's, has a mistake in it.
- An old address still appears in Google, in a bookmark or in a printed brochure.
- Bots and scanners request addresses that never existed (wp-login.php on a non-WordPress site, for example). These are harmless noise.
Are 404s bad for SEO?
A 404 for a page that should not exist does no harm; Google expects them and drops the address from its index. A 404 for a page that had rankings, links or traffic does harm, because everything that address earned is thrown away instead of being passed to a replacement. Google Search Console's Pages report lists the 404s it has found, and a crawl of your own site (Screaming Frog or any site audit tool) finds the internal links that point at them.
What matters is the pattern. One or two stray 404s: ignore. Dozens on pages that used to exist: build redirects. Internal links on your own site pointing at 404s: fix the links, because they also waste visitors' clicks.
Make the 404 page useful
A visitor who hits a 404 should see a proper page in your design that says the page was not found, offers a search box or links to the main sections, and keeps the header and footer so they can carry on. The default server error page, white with black text, loses them. A good 404 page returns the real 404 status code (not a 200 that pretends everything is fine, which confuses search engines) and is one of the small things a website audit checks.