If you take a PHP website offline to install the emergency security fixes, tell Google it is temporary by returning an HTTP 503 status code. Google and John Mueller both said this on October 21, 2026. Do not let pages time out, show a 404, or show an error page that returns 200. Keep the outage short, and keep your robots.txt file working.
What changed
On October 21, 2026, PHP released emergency fixes for two critical security flaws. According to Search Engine Roundtable, the flaws can allow attackers to run code without logging in and to read server memory, and they affect PHP versions 5.4 through 8.5.11. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. That article says the flaws, nicknamed PHP2Shell, reach roughly 70% of the world’s websites. Many WordPress sites run on PHP, so this likely includes yours.
Some site owners are taking servers offline to patch. The same day, Google Search Central posted on LinkedIn, and John Mueller of Google repeated the advice on Bluesky, as reported by Search Engine Journal. Google’s statement: “Serving a 503 (Service Unavailable) HTTP status code ensures already indexed URLs are preserved in Search while you work.”
Why the wrong response can cost you rankings
A 503 tells Google the outage is temporary, so it keeps your pages in the index and comes back later. Other responses send the wrong message. A 404 says the page is gone. A page that shows an error message but returns a 200 status can get that error text indexed instead of your content. Mueller also advised against letting requests time out.
| What visitors and Google get | What it signals | Verdict during a patch |
|---|---|---|
| 503 Service Unavailable | Temporary outage, come back later | Best choice |
| Timeout or 500 error | Something broke, no guidance on when to return | Avoid |
| 404 Not Found | The page may be gone for good | Avoid |
| Error page with a 200 status | The page is fine, and the error text may be indexed | Worst choice |
Source: Google Search Central and John Mueller on Bluesky, as reported by Search Engine Journal and Search Engine Roundtable, October 21, 2026. Mueller called a 503, 500, 403, 404, 200 ranking, best to worst, a good model.
Limits you need to know
A 503 is a short-term tool. Google’s crawl rate documentation says not to serve 503s for longer than one to two days, and if Googlebot keeps seeing 503s on the same URL for several days, that URL may be dropped from the index. In 2024, Gary Illyes said an occasional 10 to 15 minute 503 is not considered extended. While your site returns 503s, Google may crawl it less often, may not refresh titles, descriptions and structured data, and Google Ads campaigns may be paused or disapproved.
One more trap: do not return a 503 for your robots.txt file, because that can block all crawling. Also, a 503 generated by PHP code will not work when PHP itself is down. Mueller said it can come from outside PHP, such as a DNS change or a CDN.
What to do about it
- Patch fast, and keep the downtime short. Ask your host or developer whether they have already updated PHP. If they have, you may not need any downtime.
- Serve the 503 from outside PHP. Use your CDN, a web server rule or a DNS switch to a maintenance page that returns 503. Optionally add a Retry-After header to say when to come back.
- Keep robots.txt available. Make sure that one file still returns normally while the rest of the site shows 503.
- Check afterward. Open Google Search Console, review the Page indexing and Crawl stats reports for a spike in errors, and confirm your key pages return 200 again.
- Pause or watch your ads. If you run Google Ads to the affected pages, check for disapprovals after the maintenance window.
If you would rather not manage this alone, our technical SEO and AEO services include crawl, indexing and uptime checks. For another recent crawl and indexing change, read Google’s indexing API docs rewrite, or see how much SEO costs in 2026 if budget is your first question.
The bottom line
Security patching cannot wait, but your search visibility does not have to suffer for it. Serve a 503, keep the outage short, check Search Console afterward, and you can see how we approach this at GCL Marketing. You can also browse more articles by topic.
Frequently Asked Questions
What status code should I use when my site is down for maintenance?
Use HTTP 503 Service Unavailable. Google says it keeps already indexed URLs in Search while you work, because it signals the outage is temporary. Avoid 404, 500, timeouts, and error pages that return 200, since those send the wrong signal about whether your pages still exist.
How long can I serve a 503 without hurting rankings?
Google’s documentation advises against serving 503s for longer than one to two days. Short interruptions, such as 10 to 15 minutes, were described by Gary Illyes in 2024 as not extended. If 503s continue on a URL for several days, Google may drop it from the index.
Should my robots.txt file also return a 503?
No. A 503 on robots.txt can block all crawling of your site. Keep robots.txt responding normally, ideally from infrastructure that stays running while PHP is offline. Only the pages affected by the maintenance should return the 503 status code.
How can I send a 503 if PHP itself is down?
Serve it from outside PHP. John Mueller said it can come from a DNS change that points to another server, or from a CDN. A web server rule or a static maintenance page that returns 503 also works. A PHP script cannot send it while PHP is offline.
Will downtime affect my Google Ads?
It can. Google’s crawl rate documentation says Google Ads campaigns may be paused or disapproved while your site returns errors such as 503. After the maintenance window, check your ads for disapprovals, and confirm your landing pages return 200 before you resume spending.