Google tells sites to serve a 503 during PHP patch downtime

A team patching PHP for the October CVE this week must take its site offline for a short time. If the site returns the wrong HTTP status while it is down, Google can drop its URLs from the index.

Search Engine Journal, in a 21 October 2026 article by Matt G. Southern, reports that Google Search Central and John Mueller told sites to serve 503 responses during the downtime. The reminder was posted by Google Search Central on LinkedIn. Mueller amplified it on Bluesky. All quotes in this item are from the Search Engine Journal article as it reports them.

Why 503 and not 500

A 503 tells Google the site is temporarily unavailable. A 500 tells Google the site is broken. Google can drop URLs from the index when 500 or a timeout runs for more than a day or two. A 503 says come back later and keeps the current index intact.

Search Engine Journal quotes the Google Search Central post. A 503 keeps already indexed URLs in Search while the team works on the patch. Mueller tells teams to pick 503 over a timeout, a 404, or a 500. He also notes the 503 can be served outside PHP, by DNS or by a CDN.

The practical setup

The 503 must come from outside PHP itself. If PHP is the thing being patched, PHP cannot answer the request. Three paths work. The first is pointing the DNS to a static page for the window. The second is a CDN rule that returns 503 for the site during the patch. The third is a small backup server set to return 503 for the host.

Robots.txt must stay reachable. If robots.txt returns 503, Google treats the whole site as blocked and stops crawling it. The Search Engine Journal article names this directly as an error to avoid. A Retry-After header can be added to the 503 to tell Google when to try again.

How long the 503 can last

The Search Engine Journal piece gives a cap of one to two days. A 503 for longer than that can start to look like a real outage. Google may then drop URLs from the index. The 503 reduces crawl rate across the whole hostname until the error rate drops. The practical read: finish the patch inside the day, bring the site back, and let the crawler come back on its own.

The reader action

A team running PHP that is affected by CVE-2026-109618 or CVE-2026-109619 has one check to add to its runbook. Before the patch window, confirm the 503 is served outside PHP. Confirm robots.txt still returns 200. Set a Retry-After header. After the window, watch Search Console for coverage changes.

The Reveneau reader whose site runs on a serverless platform has less to do here. The patch is the platform's job, and the status page is where the news arrives. For a team running its own PHP, the 503 rule is the cheapest safety step. A quiet search drop is otherwise hard to notice until the traffic falls.

Source

Matt G. Southern, Google Reminds Sites To Serve A 503 During PHP Patch Downtime, on Search Engine Journal.