I've discovered a bit of a bug in the way Mura CMS handles 404s and wanted to share my workaround. Valid path_info for Mura pages consist of only letters, numbers, hyphens and forward slashes. If you browse to a path that doesn't exists, Mura properly throws a 404 error -- well, sometimes...
If it's a valid Mura formatted URL, you'll get a 404. For example:
...however, if the path_info is not "valid," Mura seems to ignore it and display the home page -- for example:
On some sites, you might not care about this, but Google and other spiders can become very suspicious when non-existent URLs return a 200 response instead of a 404. I discovered this when our SEO/content guru was having trouble getting Google Webmaster tools to verify after I uploaded the specified uniquely-named html file. Google refused to authenticate us, because they were attempting to "test" for a 404 and instead got 200 responses. I assume they just make up a random file name or path and expect a 404. It makes sense that they want to ensure that the site doesn't return a 200 OK for everything, because they can not count on the 200 from the authenticity file/URL to be true.
You can leverage URL rewriting as one workaround, as I have. Based on the standard default site URL format of Mura CMS, you can use something like the following with Apache mod_rewrite to force a Mura 404 when an "invalid" path_info exists:
RewriteRule ^/default/index.cfm/([^a-zA-Z0-9/-]+)$ /default/index.cfm/force-a-404-error/ [PT,L]