On October 21, 2026, Google spelled out how to take a website offline without hurting its search rankings. Public-sector and private websites in several European countries were going offline for maintenance that day to fix two critical PHP vulnerabilities nicknamed PHP2Shell. On Bluesky, Google Search Advocate John Mueller asked site owners to serve an HTTP 503 instead of letting requests time out or returning a 404 or a 500. The same day, the Google Search Central account posted a reminder on LinkedIn for anyone applying the emergency PHP patches or taking servers offline: “Don’t forget the 503!”
Two critical PHP flaws prompt precautionary shutdowns
The PHP team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. They fix CVE-2026-109618 and CVE-2026-109619, two vulnerabilities that can allow unauthenticated remote code execution. PHP had announced them the day before, with a CVSS v4.0 score of 9.2 out of 10. The advisory covers every installation that serves web requests and says the risk is highest with Apache’s mod_php.
PHP, which powers WordPress, PrestaShop, Drupal and Joomla, is used by 69.3% of websites whose server-side language is known, according to W3Techs (data as of October 21, 2026). For WordPress sites, the alert came five days after the disclosure of tampered Rank Math PRO updates.
The 8.1 branch and older no longer get updates; the project published only minimal source-code fixes for versions 7.4, 8.0 and 8.1. In alert CERTFR-2026-ALE-014, France’s CERT-FR recommended isolating systems that run these unsupported versions (5.x through 8.1.x), then migrating to a maintained version with the latest fixes. CERT-EU, which serves the EU institutions, advised organizations that could not update right away to consider isolating internet-facing applications from public networks until a fix was available, the French outlet Next reported.
In France, the Interior Ministry said it had put “all of its websites exposed to a critical security vulnerability” into “preventive maintenance” at the request of ANSSI, the national cybersecurity agency, L’Express reported, citing Le Parisien. Prefecture websites (the national government’s local offices) and the tax portal impots.gouv.fr displayed maintenance pages. Météo-France, the national weather service, said on X that it had closed “all of our websites” as a precaution. Next reported that the site of the CNIL, France’s data protection authority, went down for maintenance around 12:30 p.m. local time; the outlet took its own site offline until the patches shipped.
Google’s message: serve the 503 from outside PHP
Mueller posted at 5:26 p.m. Paris time (11:26 a.m. ET), roughly an hour and a half after the patches came out. “If you’re taking PHP sites down to schedule time to deal with ‘unplanned updates,’ use HTTP 503 instead of letting responses time out / 404 / 500,” he wrote. “You can do this outside of PHP / point DNS elsewhere / CDN.” He linked to a 2011 Google blog post on planned downtime and to Google’s guide on pausing a website.
In the replies, one user ranked the responses from best to worst: 503, then 500, 403, 404 and finally 200. Mueller replied that it was “a good model.”
The Google Search Central post on LinkedIn made the same point. “Serving a 503 (Service Unavailable) HTTP status code ensures already indexed URLs are preserved in Search while you work,” it said, adding that once a site starts serving 200 responses again, “things naturally return to normal.” The post warned against generic 404s and error pages served with a 200.
Search Engine Journal‘s Matt G. Southern pointed out a catch in the 2011 post: its example sends the 503 with PHP code, which is no help when PHP itself is what’s being shut down. The same post also advised keeping a separate server available to return the 503 during planned hardware maintenance.
How Google handles a 503, a 404 or a page served with a 200
According to Google’s documentation on HTTP status codes, a 5xx or 429 response makes its crawlers slow down. Already indexed URLs “are preserved in the index, but eventually dropped,” and any content served with those codes is ignored. An indexed URL that returns a 404, or any other 4xx code except 429, is removed from the index.
A maintenance page served with a 200 goes to Google’s indexing system like any other page. If its content looks like an error message, Search Console flags it as a soft 404, a status explained in our guide to Search Console indexing statuses. In a 2013 post now archived on his site, Mueller wrote that returning an error page with a 200 leads Google to index that change of content.
Google’s page on reducing the crawl rate, updated in October 2026, says to use 500, 503 or 429 responses only for a short period, “for example, a couple of hours, or 1-2 days.” A URL that keeps returning them for multiple days may drop out of the index. The slowdown applies to the whole hostname, including pages that still respond normally. Google Ads campaigns may also be canceled or paused.
Google’s guide on pausing a site calls taking the whole site down “an extreme measure” that should last “a few days at most.” It says not to return a 503 for the robots.txt file “because this blocks all crawling.” While a page returns a 503, Google also cannot refresh its title, description or structured data.
French government sites served maintenance pages with a 200
Between 1:17 and 1:30 a.m. Paris time on October 22, MACCUS checked several of the sites reported as shut down. The websites of six prefectures (Drôme, Ardèche, Seine-Saint-Denis, Hauts-de-Seine, Val-de-Marne and Savoie) returned their “Site en maintenance” (site under maintenance) page with a 200 status code on the home page, on the interior pages tested and at the robots.txt address. Impots.gouv.fr did the same.
| Site | Pages tested | /robots.txt |
|---|---|---|
| Six prefecture sites | 200, “Site en maintenance” page | 200, same page |
| impots.gouv.fr | 200, “site en maintenance” page | 200, same page |
| cnil.fr | 503, “Maintenance” page | 200, regular robots.txt file |
The CNIL site, by contrast, returned a 503 on its pages and let its robots.txt file respond normally, the setup Google describes. The responses were the same when the request identified itself as Googlebot. These checks ran from a MACCUS server; Googlebot, which crawls from Google’s own IP addresses, may have received different responses. None of these sites gave a date for coming back online.
The limits of Google’s guidance
Google sets no precise threshold. Depending on the page, the window runs from “1-2 days” to “a few days at most,” and the LinkedIn post gives no duration at all. For longer closures, the pausing guide recommends an indexable home page served with a 200 “as a placeholder.”
Google’s guidance is about indexing. On security, the PHP team says there are no complete mitigations and that updating is the only safe choice: a 503 page does not fix the flaw.
In December 2021, during the Log4j vulnerability alert, Mueller advised serving a static version of the site on the same URLs and said that “temporary technical issues are not a sign of a low-quality website,” according to Search Engine Roundtable.
What it means
Google has been repeating this rule since at least 2011. On October 21, it collided with an alert that Next said had reached “unprecedented proportions”: government agencies, media outlets and companies shut down their sites on the same day, often in a hurry. At the Interior Ministry, ANSSI asked for the shutdown. Sites on shared hosting get whatever page their host displays during the work.
Google says a short 503 keeps indexed URLs in search and that things then return to normal. It does not say how long recovery takes: its documentation only says the crawl rate climbs back gradually once 2xx responses return, and its crawlers revisit each site at very different rates, according to the internal estimates Google presented in early October. Nor does Google quantify the effect of a few hours of maintenance pages served with a 200, which can be indexed in place of the real content or flagged as soft 404s. Mueller’s 2013 post said only that a site that could not return a 503 would probably take “a bit of time” to settle back down in search, “but it’ll come back.”
Ranking changes over the coming days will be hard to read. Search Engine Roundtable reported heavy ranking volatility on October 20 and 21, which Google has not confirmed, and the Google Search Status Dashboard lists no update since the September 2026 spam update. Nothing so far links that volatility to the site shutdowns.
In the days ahead, crawl and indexing reports for the reopened sites will show whether soft 404s or deindexed URLs follow the closures that served a 200 or a 404. As of early October 22, Paris time, no official announcement had set a date for the prefecture sites to come back online.
Sources
- Security advisory: Critical remote code execution vulnerabilities, update now, PHP, October 21, 2026
- Multiples vulnérabilités dans PHP (CERTFR-2026-ALE-014), CERT-FR, October 21, 2026
- Post by John Mueller on taking PHP sites offline, Bluesky, October 21, 2026
- Google Search Central post on emergency PHP patches (“Don’t forget the 503!”), LinkedIn, October 21, 2026
- How HTTP status codes affect Google’s crawlers, Google, February 4, 2026
- Temporarily pause or disable a website, Google Search Central, December 10, 2025
- Failles critiques PHP : les correctifs sont en ligne et à installer rapidement, Next, October 21, 2026
- « Actuellement en maintenance » : de nombreux sites institutionnels inaccessibles en France ce mercredi 21 octobre, L’Express (6Médias), October 21, 2026
Header image: MACCUS chart, data from Google Search Central and Google documentation, October 2026
