Google says serve a 503 if the PHP patch takes your site offline

Google's advice, posted on 21 October 2026 as PHP shipped urgent patches for two critical flaws, is short: if you take your site offline while the patch goes in, answer every request with a 503. It applies to every South African business on WordPress, which runs on PHP, and to any site whose host is patching this week.

What changed

PHP's emergency releases on Wednesday close two holes that let an attacker run code on a server without logging in. Patching is a job for whoever runs the server, and some owners are pulling their sites down until it's done. Google Search Central told them on LinkedIn that day how to do it without losing their place in Search. In its words, "Serving a 503 (Service Unavailable) HTTP status code ensures already indexed URLs are preserved in Search while you work." The same post warned against letting the server fall back to a generic 404, or to an error page that comes back with a 200.

A Google search advocate made the same point on Bluesky, saying a 503 beats letting requests time out or answer with a 404 or 500, and added the detail most people miss. Whatever sends the 503 can't be PHP, because PHP is the part that's switched off. A CDN rule or DNS pointed at a temporary server will do. Google's 2011 guide to planned downtime includes a PHP snippet for sending the 503, which is useless here.

Google's documentation covers the rest. Its guide to pausing a website treats switching off a whole site as a last resort, for a few days at most, and says a 503 page suits an urgent closure of one to two days. The crawl rate page explains what happens when Google meets enough 500, 503 or 429 responses: it slows crawling for the whole hostname, pages that still load included, and picks up again once the errors stop. The status code page adds that pages already in the index ride out server errors for a while, then get dropped if the errors persist.

Two warnings in the pause guide matter more than the rest. Don't send a 503 for robots.txt, since Google treats that as a block on all crawling. And don't hide the site with a 403, 404, 410 or a noindex tag, all of which take your URLs out of Search.

What it means for South African businesses

Nothing here needs to roll out to South Africa. Google's crawling documentation names no country or region; it describes how Googlebot treats every site it visits, .co.za sites included. To see what Googlebot met on your own site, open Search Console and go to Settings, then Crawl stats, where requests are split by response code.

One line in the pause guide deserves a local business's attention: Google generally crawls from the US. If your host or firewall reacts to this week's flaws by blocking foreign traffic, Googlebot gets locked out with the attackers, and the site looks offline to Search while customers in Durban or Polokwane can still load it. If you use a South Africa only rule, let verified Googlebot traffic through.

Our view: patch first, then worry about rankings. A Google analyst said in 2024 that a 503 lasting 10 to 15 minutes now and then isn't an extended outage, and Google's own post says things return to normal once pages answer with 200 again. A server left open to a flaw that lets strangers run code is a far bigger risk to your search presence than a short outage. Crawl problems after downtime are one of the technical fixes in our SEO service, but the cheapest fix is an outage that tells Google exactly what's going on.

What to do now

1. Email your host today and ask two things in writing: has your server's PHP been updated with the 21 October fixes, and will there be downtime? If your site runs PHP 8.1 or older, ask what the plan is, because official support for those versions has ended and PHP has only released limited source patches for 7.4 to 8.1.
2. If you have to go offline, send the 503 from something that doesn't run on PHP: a maintenance rule at your CDN, a static page set in the web server's configuration, or DNS pointed at a temporary server. Add a Retry-After header with your best guess at a return time, in seconds or as a UTC date. Keep the page plain HTML with inline styles, and put a phone or WhatsApp number on it.
3. Leave robots.txt answering with a 200, and don't disallow crawling in it. If your maintenance rule catches every URL, carve robots.txt out. Then run curl -I against your home page from your own computer: it should report 503, and the same check on your robots.txt file should report 200.
4. Give the outage a limit of a day or two. If the work will run longer, swap the 503 for a simple home page that returns 200, explains what's happening and gives the date you expect to be back.
5. Once you're back up, open Search Console. Check Crawl stats for the run of server errors, use URL Inspection to request indexing of your home page and main service pages, and resubmit your sitemap so Google rechecks the rest. Look at the Pages report again a week later for anything that dropped out.

Sources

• Google Reminds Sites To Serve A 503 During PHP Patch Downtime, Search Engine Journal, 21 October 2026
• Temporarily pause or disable a website, Google Search Central, 22 October 2026
• Reduce the Google crawl rate, Google Crawling Infrastructure, 22 October 2026
• How HTTP status codes affect Google's crawlers, Google Crawling Infrastructure, 22 October 2026