> the url remains the same, but the page has the status code 404,

This is certainly the preferred option, as Martijn suggests. For a "custom" error page on Apache (ignoring the CMS option for a moment), this could be achieved with the `ErrorDocument` directive:

    ErrorDocument 404 /errors/my404.php

> it can be a default server 404 page

Using the `default` keyword clears any custom URL that might have been set and results in the servers default error document being served.

    ErrorDocument 404 default

> or a default 404 page of CMS

Since a CMS is often serving pages defined in a database it's not possible to use the `ErrorDocument` directive to handle 404s, since whether a request results in a 404 is only known much later in the request. The CMS detects that the requested URL does not exist and manually serves a `404 Not Found` header with some appropriate page content.

> an url changes to /404.html

For the URL to change there must be some kind of external _redirect_. Most probably a 3xx status code. To me, this would suggest a misconfiguration. The user-agent first sees the 3xx status code, not a 404. The document being redirected to may or may not then serve a 404 (it should). The user-agent ends up issuing 2 requests (because of the redirect). Providing the end-point returns a 404 status it is still effectively a 404.

Other caveats with issuing a redirect to the error document is that you lose the original URL (to provide a meaningful message to your user) and other details (server variables) related to the error. (This information would need to be manually passed somehow if it was required.)

There is rarely a _need_ to redirect to a 404. On Apache, this is possible again with the `ErrorDocument` directive. If you specify an _absolute_ URL (with protocol and hostname) as the error document argument then Apache issues a 302 (temporary) redirect (regardless of whether the URL actually resides on the same server):

    ErrorDocument 404 http://example.com/errors/my404.php

This is primarily for redirecting to an external resource (should that be a requirement). But the same caveats with issuing a redirect apply, as mentioned above.