First, I think it's interesting to define what an error message is and what it's for.

According to the reliable dictionaries of the Portuguese language, Priberam, Michaelis and Aulete an error, synthesized, would be:

That which results from a poor understanding or poor analysis of a fact or a subject. Deception, inaccuracy or inaccuracy. Inaccurate conceptualization of an idea or flawed interpretation of a subject, of a theme; inaccuracy. Lack of correctness, accuracy, perfection, etc.; Failure; Defect; Imperfection.

About purpose of an error message, the following definition fits well:

The purpose of an error message is to help the user who encountered the error, learn how to avoid the behavior that caused the problem. The program has encountered a situation that it can not handle and needs to tell the user, so that the user (or someone else) understands and can avoid the situation that the program cannot handle. [...] Generic error message that says, "an unexpected error occurred" is totally useless in this goal. It gives the user no suggestions on what can be changed to avoid the problem, or even fix that problem.

By understanding this definition, it is possible to establish three important points for a good error message:

• inform what the problem is.
• make you feel like you there was something you could do about it.
• speak like a human and be a consistent extension of the personality of the rest of the application.

Do a redirect to another page?

Should she redirect to another page? How long after?

Generally speaking, it is not recommended that you redirect the user to another page, especially if it is to a page outside your domain. The main reason is that you you never know for sure where the user really wants to go.

If the user is trying to access an old URL that has been moved, it is good to redirect them to the old URL and report that there has been a change of address, and then give the option to follow the link to the new page. But you really should be using a 3xx redirect instead of a 404.

HTTP Error Codes should never be exchanged and / or misused. Imagine if you for servicing a page that is returning error 500 (Internal Server Error), while in fact, the actual error is 403 (Access Denied). Unless you are a seer, and I apologize if you are, how are you going to find out where the error came from and how are you going to fix it?

Leave a search box?

Should

Have an index? A box and free search? Or already do the search suggesting pages based on what was typed?

Depends on what kind of application and the target audience is being treated. In more common cases, it is interesting to leave a box for free search. Especially if you already have a fixed navigation bar with a search box (as in the case of Stack Overflow ) that will show more links suggesting other locations, it is unnecessary to do both.

In these cases, adopting a page showing related topics is advantageous. It may not be the friendliest alternative in matters of UX ( some agree, others they disagree ), but as in the case of Stack Overflow that keeps the navigation bar constantly on all pages, the option of page suggestions is something to consider.

Show the error explicitly?

Should she demonstrate that it is a mistake? Should it show the 404? Or is it better something cleaner and look like something normal and that just need to do something else?

It is useful to show the number 404, for the following reasons:

• he is a shorthand for error. The number 404 already synthesizes an error message;
• the vast majority of people know what 404 means, even if in a simplified way;

Demonstrating the error is the best option. It is already public knowledge that escaping from problems, is not the best alternative (both in life, and in programming). The problem simply grows, turns into a snowball and will only generate more headaches. It even has Talking phrases addition:

Do not run away from your problems or despair. Face them face to face with courage and determination, for if you do not solve them today, you will certainly have to do it tomorrow because they will continue to exist until they are solved, prolonging your suffering.

^{Source: Thinker}

Briefly, I already talked about this in another answer :

[...] In a synthesized way, explain the minimum for your user, but in a clear and understandable way, and if possible do something that allows the user to know that the problem is not being ignored. Let them take some action, such as sending the logs or sending an error report. Alternatively, let them know that the automatic action has already been taken and that your technical personnel have been automatically notified that this error has occurred and are working on it.[...]

How should the design of the error page look like?

A page should keep the design of the site or have something neutral? Should it be well cleaned or with as much information as possible? Should you take advantage of something else? Publicity?

The above excerpt already covers a part of the Question:

[...] In a synthesized way, explain the minimum to your user, but in a clear and understandable way, and if possible do something that allows the user to know that the problem is not being ignored. Let them take some action, how to send the logs or send an error report. Alternatively, let them know that the automatic action has already been taken and that your technical personnel have been automatically notified that this error has occurred and are working on it.[...]

Keep the design in the default of your site and the error message in a simple and understandable way. Some reasons to follow this idea are:

• your user is not a expert in errors, or a full stack web developer, then returning the entire error code, and/or the error stack makes no sense (in cases of extra errors).

The error should be shown to whoever will solve the problem. Is it the user? No! So don't show him what he won't solve. Show a minimal, complete, and understandable error message that tells you why and if you can do anything to collaborate.

• If you change the design of the error page, your user may think that he clicked on some improper link, and was redirected to some third-party website.

Try to maintain cohesion between error pages with the rest of your site. Be a consistent extension of the personality of the rest of the application. And please no ads when error is occurring. By doing this, the user could easily think: "it has time to place ads, but it does not solve this crap."

• so alternatively, try to understand that when the most lay user sees an error message, the first thing he looks for, almost always, is the close button (it's amazing). You can give 2 lines of message, or a whole stack trace, and even then, there will be users who will not read.

Want an example of this? I'm sure that not half of the people of the same Stack Overflow in English know firsthand what appears written in the modal that appears when you click the button answer your question (I know you looked now to see what you had written). So from these and others, you can see that there is no reason to report multiple "strange" and "numerous error lines"codes.

Is it worth making an apology?

The error can be from the site or the user who typed something wrong, or even from who put a wrong link to it, then it can be from a third party. This is a case concrete to apologize or not?

Apologize . The user is accessing your website, your responsibility. Imagine the following situation: you go to the bakery and have no bread, for whatever reason, since the machine has broken, the power has run out, the Baker broke his leg, there was no more yeast, or there was no downhill harvest, and there were no ways to make flour. The owner of the bakery, will say:

I'm sorry, but it happened XYZ, and then blah, blah, blah...

Besides being a matter of education (it's good and I like it, and I believe you like it too), you'll be showing that you care about the user. There is also an excerpt from the excellent answer on the appropriate apology which reads:

[...] The fact is that the excuse is an important social lubricant, the character of which in the interaction also serves as a way to indicate the real intention of the interlocutor (something like "I really did not want to tell you"). hurt / Disturb on purpose"), and so it is traditionally used to start a conversation considering a possible interruption of any introspection / activity of the recipient of the message [...]

See that when you apologize, you are "preparing the atmosphere" of the interaction, which still makes it possible, in this case, to offer other products to your customer (just as the bakery owner does). If that were the case, he would say something like, " we don't have X today, but how about take a tasty Y and / or Z. We also have a and B available if you want".

Concluding

After these considerations, I believe you can also take a look at these 404 error pages, which exemplify what was said in this answer:

• GitHub
• User Experience
• Microsoft TechNet
• Blizzard Entertainment

Notice that all, implements almost everything that has been said. Have apologies, synthesized information, search box, and the standard usage convention. Logical that there is no error page perfeita perfect. The logic of each page varies greatly with its target audience and the philosophy of the developers. But in general they follow conventional wisdom and " good practices ".

About 404:

• Well, let's say the code 404 is just an HTTP protocol response code that notifies systems and APIs about an invalid search within that system. (TL; DR: wrong URL address within that domain). There are several other codes, and they have the sole purpose of helping the programmer to deal with exceptions about the application.

My view on the pages:

Most sites take advantage of this status code and display pages with this error code to your customers in case the URL accessed is incorrect.

• in my view it is necessary that there be a brief and clear text of the possible error. Also do not make redirects and maintain the structure of the site, because it is important that the user knows where and why the error. (Leave an easy search or even create a mechanism that makes a suggestion by related words that URL is a valid solution also)

Examples:

• User tried to access site.com/home but accessed site.com/hoem

• User tried to access a page that no longer exists.

Notes:

It is also common to see the use of maintenance pages of the site (in case it is out of the air due to some error, problem or even a maintenance). On this page yes you should explain in a generic way about the problem and try redirecting to the same request fails over and over again.