The World Wide Web is rushing now to fix and patch its servers for the critical PHP exploit known as PHP2Shell. Most are able to patch these without downtime but many sites are going offline until the patch is implemented, just to be super safe. Google's John Mueller offered advice on how to handle Google Search if you decide to take down your site while patching it for the PHP security vulnerability.
If you are unaware of this PHP issue, in short, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 now have a fix for two critical vulnerabilities that can allow unauthenticated remote code execution. So everyone is rushing to patch things up asap before the evil people or bots begin attacking. There is tons of coverage of this summed up on Techmeme.
In fact, many sites are being taken offline, to be super cautious, until the PHP patches are in place. "Several government, school and hospital websites in Europe were taken offline on Wednesday as organizations rushed to protect themselves from two critical security flaws in PHP, a programming language that powers a large share of the internet," Reuters reported.
If you are taking that approach, Google's John Mueller provided advice on how to take down your site, so that it won't result in long term ranking or indexing issues for your site in Google Search. John wrote on Bluesky, "If you're taking PHP sites down to schedule time to deal with "unplanned updates", use HTTP 503 instead of letting responses time out / 404 / 500. You can do this outside of PHP / point DNS elsewhere / CDN."
Google has spoken about this before in similar cases but Google also has older documentation on this - here are links to those documents:
Google has given similar advice in 2021 with the Log4j security vulnerability.
Here is some of our previous coverage of how Google Search handles sites being down and what to do:
- Google SEO Tips On Taking A Site Offline To Fix Log4j Security Vulnerability
- Site Down Time Can Remove You From Google Index
- Google On How To Technically Pause Your Online Business
- Site Down Too Long? Your Google Rankings Will Suffer
- Site Down? How To Use A 503 Code To Save Your Google Rankings
- Google: Site Going Offline For Longer Than A Day; Upload A Static Version
- Google: Use 503 Status Code Only For Hours, Not Weeks
- Jewish High Holy Days Approaching: Google Shares Tips On How To Temporarily Close Your Site
- Google Official Tips On Closing A Site For Days (For Maybe Shabbat)
Here is John's post:
If you're taking PHP sites down to schedule time to deal with "unplanned updates", use HTTP 503 instead of letting responses time out / 404 / 500. You can do this outside of PHP / point DNS elsewhere / CDN. developers.google.com/search/blog/... developers.google.com/search/docs/...
— John Mueller (@johnmu.com) October 21, 2026 at 11:26 AM
[image or embed]
Forum discussion at Bluesky.
