404 means "not here" (might never have existed, might come back). 410 means "permanently gone, do not look for it again". 410 is rarely used; 404 is the catch-all.

Should I return 404 or 403 for resources the user lacks permission to see?

Either is defensible. 404 leaks less (does not confirm the resource exists). 403 is more honest. Pick one and apply consistently.

Why does Google sometimes show "soft 404"?

A soft 404 is a 200 response that looks like a 404 page (e.g. "page not found" content with a 200 status). Google penalizes soft 404s; always return a real 404 status for missing pages.

A few are fine and expected. Mass 404s on previously-indexed URLs hurt rankings. Use 301 to redirect to a relevant replacement when possible.

404 Not Found: HTTP Status Code Meaning, Causes, and Fixes

What 404 Not Found means

404 Not Found is the most famous status code on the web. The URL does not match any resource the server knows about. This can mean the resource was deleted, the URL is misspelled, the resource never existed, or (deliberately) the resource exists but the server is hiding it from this caller for security reasons. 404 makes no statement about whether the resource ever existed; for "this used to exist and is permanently gone", 410 Gone is more accurate.

When servers should return it: Return 404 when the requested resource does not exist at the given URL. Do not return 404 for permission failures (use 403) or for malformed requests (use 400).

Common causes

URL typo (most common cause in browsers)
Resource was deleted
Resource never existed
Wrong API version in the path (/v1 vs /v2)
Trailing slash mismatch on a strict server
Case sensitivity (some servers treat /Foo and /foo differently)
Resource is hidden from the current caller for security reasons

How to fix 404 Not Found

Double-check the URL for typos
Verify the API version path component
Check the server logs for the exact request path received
Confirm the resource still exists (was it deleted?)
For static files, verify the file is in the build output and deployed
For dynamic routes, check the route definition matches the URL pattern

Example response

curl -i https://api.example.com/users/999999

HTTP/2 404
content-type: application/json
{"error":"user not found","id":"999999"}

More references

For a one-page reference of all HTTP status codes, see the HTTP cheat sheet. For testing API responses, try the API Tester tool. For inspecting responses on the command line, the curl cheat sheet covers the most common flags.