On October 21, 2026, PHP released emergency fixes for two critical flaws that can let attackers run code without logging in. Many site owners had to take their sites offline to patch. The same day, Google Search Central reminded everyone how to do it without losing rankings: return a 503 Service Unavailable status while the site is down.
Why a 503, and not anything else
A 503 tells Google that the outage is temporary and that it should come back later. Other responses send the wrong message:
- A 404 or 410 says the page no longer exists. Pages can be dropped from the index.
- A 500 error signals a broken server; many of them reduce how often Google crawls the whole site.
- A “we’ll be back soon” page with a 200 is the worst option: Google sees a normal page, and John Mueller noted that error pages served with a 200 can get indexed, replacing your real content in search results.
- Timeouts look like an unreachable server and also slow crawling.
Serve the 503 from outside PHP
This is the detail most guides miss. Google’s old example sends the 503 from PHP code, but if PHP itself is what you are taking offline, that code will not run. The response has to come from something still working:
- A CDN rule, for example a maintenance rule in Cloudflare that returns 503 for all requests.
- The web server: an Nginx or Apache rule that returns 503 before reaching PHP.
- A temporary server, pointing DNS to a simple host that returns 503 for every URL.
An example for Nginx, with a Retry-After header that tells crawlers when to come back:
location / {
add_header Retry-After 3600 always;
return 503;
}
location = /robots.txt {
try_files $uri =404;
}Keep robots.txt reachable
If robots.txt itself returns a 503, Google stops crawling the whole site until it can read it again. Keep it responding normally, as in the example above, so Google knows what it may crawl once you are back.
Keep it short
- One or two days at most. Google advises against returning 503 for longer. URLs that return 503 for several days may be dropped from the index.
- For longer closures, Google’s guidance is to serve a placeholder home page with a 200 that can be indexed, instead of a long 503.
- Expect a short crawl slowdown. Many 5xx or 429 responses reduce crawl rate for the hostname. Crawling recovers on its own once errors stop.
Check it before and after
Before you go offline, test that the maintenance response returns 503 with our HTTP Header Checker, and that robots.txt still loads with the robots.txt tester. When the site is back, confirm that your key URLs return 200 with the Redirect Checker and watch the Crawl stats report in Search Console for a few days.
Frequently asked questions
Frequently asked questions
What status code should I use for site maintenance?
A 503 Service Unavailable, ideally with a Retry-After header. It tells search engines the outage is temporary.
How long can a site return 503 without losing rankings?
Google advises no more than one or two days. Longer 503s can cause URLs to be dropped from the index.
Should robots.txt return 503 during maintenance?
No. A 503 on robots.txt makes Google pause crawling the whole site. Keep it responding normally.
Is a maintenance page with a 200 status OK?
Only for long closures, as an indexable placeholder home page. For short maintenance, a 200 error page can get indexed in place of your content.