the url remains the same, but the page has the status code 404,
This is certainly the preferred option, as Martijn suggests. For a "custom" error page on Apache (ignoring the CMS option for a moment), this could be achieved with the
ErrorDocument 404 /errors/my404.php
it can be a default server 404 page
default keyword clears any custom URL that might have been set and results in the servers default error document being served.
ErrorDocument 404 default
or a default 404 page of CMS
Since a CMS is often serving pages defined in a database, it's not possible to use the
ErrorDocument directive to handle 404s for pages defined (or not) in the CMS, since whether a request results in a 404 is only known much later in the request. The CMS detects that the requested URL does not exist and manually serves a
404 Not Found header with some appropriate page content.
an url changes to /404.html
For the URL to change there must be some kind of external redirect. Most probably a 3xx status code. To me, this would suggest a misconfiguration. The user-agent first sees the 3xx status code, not a 404. The document being redirected to may or may not then serve a 404 (it should). The user-agent ends up issuing 2 requests (because of the redirect). Providing the end-point returns a 404 status it is still effectively a 404.
Other caveats with issuing a redirect to the error document is that you lose the original URL (to provide a meaningful message to your user) and other details (server variables) related to the error. (This information would need to be manually passed somehow if it was required.)
There is rarely a need to redirect to a 404. On Apache, this is possible again with the
ErrorDocument directive. If you specify an absolute URL (with protocol and hostname) as the error document argument then Apache issues a 302 (temporary) redirect (regardless of whether the URL actually resides on the same server):
ErrorDocument 404 http://example.com/errors/my404.php
This is primarily for redirecting to an external resource (should that be a requirement). But the same caveats with issuing a redirect apply, as mentioned above.