Search

Google tells sites patching the PHP flaws to serve a 503, not a 404, so indexed pages stay in Search

Developing

Neither the post nor the linked documentation gives a time limit for how long a 503 keeps pages indexed.

Network cables plugged into a switch
Photo: Network cables and switch by ProjectManhattan, CC BY-SA 3.0, via Wikimedia Commons

In 60 seconds

  • The post opens "Don't forget the 503!" and says a 503 keeps already indexed URLs in Search during downtime.
  • The trigger is two PHP flaws rated 9.2 by CERT-EU; CERT-EU and the US NSA advised isolating or taking unpatched systems offline.
  • Google's documentation: 4xx (except 429) removes indexed URLs; 429 and 5xx slow crawling and URLs are preserved for a time but "eventually dropped" if errors persist.
  • Error content served with a 200 can be reported as a soft 404.

Impact Layer

What changed
Google has given specific guidance for the emergency downtime many sites will use this week.
Why it matters
Taking a site down with the wrong status code can remove pages from the index and cost rankings.
Who is affected
Site owners, developers and SEOs, especially WordPress and PHP site administrators.
Martech stack area
SEO & Search, CMS
Stack impact
If you must take a site offline, return 503 with a Retry-After header, keep downtime short and restore 2xx responses as soon as you have patched.
Business impact
High PPC Land's reading of a Google Search Central LinkedIn post and the status code documentation. No time limit is given and crawl-rate recovery time is not stated.
Related vendors
What to watch
How quickly crawling recovers after sites return.

On October 21, 2026, at about 17:40 UTC, Google Search Central posted on LinkedIn urging sites applying emergency PHP patches or taking servers offline to serve a 503 status code, according to PPC Land.

The trigger

PHP shipped fixes for two flaws that CERT-EU rated 9.2 on CVSS. CERT-EU and the US NSA advised isolating or taking unpatched systems offline.

The post

It opens with “Don’t forget the 503!” and warns against generic 404s or 200 error pages during maintenance. A 503 keeps already indexed URLs in Search during downtime.

What the documentation says

From “How HTTP status codes affect Google’s crawlers” (last updated February 4, 2026):

  • 4xx (except 429): indexed URLs are removed from the index.
  • 429 and 5xx: crawling slows; indexed URLs are preserved for a time but “eventually dropped” if errors persist.
  • 2xx: success does not guarantee indexing; error content served with a 200 can be reported as a soft 404.
  • Redirects: 301 and 308 are strong signals; 302, 303 and 307 are weak; crawlers follow up to 10 hops by default.
  • Recovery: after 2xx responses resume, crawl rate increases gradually.

Not stated

How long a 503 can last before pages are dropped, how long crawl-rate recovery takes, and how robots.txt errors are handled (the page refers to a separate specification).

Our read

Patch first. If you must take a site down, a 503 with a short window is the safe signal.

Sources

  1. PPC Land: Google tells sites patching PHP to serve 503, not 404, to keep pages indexed (opens in a new tab) News report ·

    Source for the post, documentation summary and what is not stated.

Get MarTech Roundup in your inbox

What changed in marketing technology, why it matters, and what to do next.

We will email you to confirm. You can unsubscribe at any time.

Related stories