Skip to main content
BRYNby Civic
AboutTrustBrandLegalAlso from CivicCivic Auth opens in a new tabCivic MCP opens in a new tab
Log inGet Started

Noise-to-Motion/#010/Post

PHP sites are going offline to patch. Google says serve a 503

PHP shipped fixes for two critical flaws on Oct 21, and if your WordPress marketing site has to go offline to take them, Google's John Mueller says answer with a 503, not a timeout, 404 or 500.

Light hero titled “Down for a fix? Say 503.” showing the same page taken offline two ways. Pulled offline, /pricing returns 404 or 410 and Google removes the URLs. Paused for a patch, /pricing returns 503 with Retry-After for 1 to 2 days.
Figure

01 ⬩ What shipped

PHP is patched. Some sites are going dark to apply it

The PHP project shipped fixes on Oct 21 for two critical flaws that, under the right conditions, let an attacker run code on a PHP server without logging in, and if your marketing site goes offline to take them, the way it goes dark decides what Google does with it. The PHP Foundation, Oct 21, 2026 names the releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and is plain about it: "If you run PHP, it is imperative that you update now."

If your site runs on WordPress, it runs on PHP. The advice from the top has been to move fast. Here's the post from NSA's cybersecurity team, which also told anyone who can't update right away to take the system offline until it's fixed.

Most sites patch without downtime, per Search Engine Roundtable, Oct 21, 2026. Plenty are going offline anyway, to be safe. That second group is who this is for.

Post on XOpen
NSA Cyber
@NSACyber

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.

Oct 21, 2026
01 ⬩ X ⬩ @NSACyber

02 ⬩ What it changes

Going dark is a search decision, not only a server one

The person who patches the server is rarely the person who owns the rankings. At a small company the second person is often the first growth hire, and nobody tells them the site is coming down. The patch is an engineering job. How the site goes dark is a growth job, and it's usually nobody's.

Google's John Mueller put the rule in one line on Bluesky, as Search Engine Roundtable reported: use HTTP 503 "instead of letting responses time out / 404 / 500." Barry Schwartz flagged it the same morning.

Google Search Central's guide to pausing a site fills in the rest. A 503 is for a site that has to be down 1 to 2 days. Longer than that, Google wants an indexable home page that returns 200. A 403, 404 or 410, or a noindex tag, removes the site's URLs from Google Search, and Google says recovering from a full removal "can take quite some time." Nobody wants to explain a rankings drop caused by a security fix.

Post on XOpen
Barry Schwartz
@rustybrick

Google on how to handle Google Search if taking down your site to fix the emergency PHP exploit #PHP2Shell

Oct 21, 2026
02 ⬩ X ⬩ @rustybrick

03 ⬩ What to do today

Ask two questions before anyone pulls the plug

It's the job nobody wrote down, so write it down today. Ask whoever runs your hosting which PHP version the site is on, and whether it's one of the four patched releases. Then ask what the site will return if it has to go offline to patch. The answer you want is a 503, and Mueller notes it can come from outside PHP entirely: point DNS elsewhere or serve it from your CDN. If the answer is "we'll just switch it off," that's the one to change.

Taking a site down for a patchGoogle Search Central
  1. 1Return a 503 on every page, with a Retry-After header.
  2. 2Leave robots.txt crawlable. Never serve it a 503; that blocks all crawling.
  3. 3Skip 403, 404, 410 and noindex. Each one removes the URLs.
  4. 4Down past 1 to 2 days? Serve an indexable home page that returns 200.
  5. 5Check it with curl -I before you walk away.
Taking a site down for a patch
03 ⬩ Figure ⬩ Taking a site down for a patch

04 ⬩ Sources

Where this came from