Custom error messages should be turned 'Off' (False) because detailed error messages leak information that helps attackers. Verbose errors can reveal file paths, database schema, server versions, and implementation details that attackers use to plan attacks. Generic error messages give users enough information without exposing system internals. This is a standard hardening practice called 'information disclosure prevention.'