# PHP sites are going offline to patch. Google says serve a 503

*Published 2026-10-22* | Author: brad-webb

PHP shipped fixes for two critical flaws on Oct 21, and if your WordPress marketing site has to go offline to take them, Google's John Mueller says answer with a 503, not a timeout, 404 or 500.

## PHP is patched. Some sites are going dark to apply it

The PHP project shipped fixes on Oct 21 for two critical flaws that, under the right conditions, let an attacker run code on a PHP server without logging in, and if your marketing site goes offline to take them, the way it goes dark decides what Google does with it. The [PHP Foundation, Oct 21, 2026](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) names the releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and is plain about it: "If you run PHP, it is imperative that you update now."

If your site runs on WordPress, it runs on PHP. The advice from the top has been to move fast. Here's the post from NSA's cybersecurity team, which also told anyone who can't update right away to take the system offline until it's fixed.

> Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.
>
> NSA Cyber, @NSACyber, [post on X](https://x.com/NSACyber/status/2112903220209098897)

Most sites patch without downtime, per [Search Engine Roundtable, Oct 21, 2026](https://www.seroundtable.com/google-php2shell-42353.html). Plenty are going offline anyway, to be safe. That second group is who this is for.

## Going dark is a search decision, not only a server one

The person who patches the server is rarely the person who owns the rankings. At a small company the second person is often the first growth hire, and nobody tells them the site is coming down. The patch is an engineering job. How the site goes dark is a growth job, and it's usually nobody's.

Google's John Mueller put the rule in one line on Bluesky, as Search Engine Roundtable reported: use HTTP 503 "instead of letting responses time out / 404 / 500." Barry Schwartz flagged it the same morning.

> Google on how to handle Google Search if taking down your site to fix the emergency PHP exploit #PHP2Shell
>
> Barry Schwartz, @rustybrick, [post on X](https://x.com/rustybrick/status/2112934010221453504)

[Google Search Central's guide to pausing a site](https://developers.google.com/search/docs/crawling-indexing/pause-online-business) fills in the rest. A 503 is for a site that has to be down 1 to 2 days. Longer than that, Google wants an indexable home page that returns 200. A 403, 404 or 410, or a noindex tag, removes the site's URLs from Google Search, and Google says recovering from a full removal "can take quite some time." Nobody wants to explain a rankings drop caused by a security fix.

## Ask two questions before anyone pulls the plug

It's the [job nobody wrote down](https://www.civic.com/field-notes/the-job-nobody-wrote-down), so write it down today. Ask whoever runs your hosting which PHP version the site is on, and whether it's one of the four patched releases. Then ask what the site will return if it has to go offline to patch. The answer you want is a 503, and Mueller notes it can come from outside PHP entirely: point DNS elsewhere or serve it from your CDN. If the answer is "we'll just switch it off," that's the one to change.

*Taking a site down for a patch*

Today, ask your host which PHP version your site runs, and get a yes that any takedown to patch it answers 503 with a Retry-After header and leaves robots.txt alone.

## Where this came from

- [Today's PHP Security Release, and How We're Strengthening PHP Security](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), The PHP Foundation, Oct 21, 2026
- [NSA Cyber (@NSACyber) on X](https://x.com/NSACyber/status/2112903220209098897), Oct 21, 2026
- [Google On Taking Sites Down When Fixing The Emergency PHP Exploit](https://www.seroundtable.com/google-php2shell-42353.html), Search Engine Roundtable, Oct 21, 2026
- [Barry Schwartz (@rustybrick) on X](https://x.com/rustybrick/status/2112934010221453504), Oct 21, 2026
- [Temporarily pause or disable a website](https://developers.google.com/search/docs/crawling-indexing/pause-online-business), Google Search Central, Dec 10, 2025

Source: https://www.civic.com/noise-to-motion/php-patch-take-site-down-with-503