Key takeaways
- For a short security outage of one or two days, Google's advice is to return a simple error page with a 503 status code and a Retry-After header.
- For PHP2Shell, the offline page must not be made by PHP. A WordPress maintenance mode plugin still runs PHP, so it does not remove the risk.
- Never use noindex, a 404 or 410 page, a "disallow all" robots.txt or Search Console's removal tool for a temporary closure. Google says those can drop your pages from search.
The short answer
If your host cannot confirm your PHP is patched against PHP2Shell, and you decide to take the site down until it is, ask your host to serve a plain HTML maintenance page at the server level with an HTTP 503 status and a Retry-After header, and to leave your robots.txt file reachable. Google's guidance says that setup is fine for a day or two. If the outage might last longer, Google recommends a normal placeholder home page with a 200 status instead.
The mistake to avoid is switching on a maintenance mode plugin in WordPress and assuming the site is safe. The visitor sees a "back soon" page, but that page is still produced by PHP on the same server. PHP's own advisory says the most serious version of the attack can start before any website code runs, so a plugin cannot stop it.
Should you take your site offline at all?
Most small businesses will not need to. If your host confirms in writing that your server runs a fixed PHP version, keep the site up. Taking it down costs you enquiries and, if it lasts, some search visibility.
It is worth considering when all of these are true: your site runs on PHP, nobody can confirm the patch today, and the site holds customer data such as accounts, orders or form submissions. That matches what the security agencies said. The Canadian Centre for Cyber Security advises isolating internet facing applications from public networks if you cannot patch straight away, and Japan's Prime Minister Sanae Takaichi told site operators that temporarily closing a site is an effective way to reduce the risk when quick patching is hard.
What Google says about pausing a website
Google's page on pausing a website prefers keeping a site online with limited features. It calls full removal an extreme measure for a very short time, a few days at most, and warns that there is no fixed timeline for recovering search visibility afterwards. Its specific rules for a short outage:
- Return a 503 status code on an informational page for one or two days.
- Add a Retry-After header with your best guess of when the site will be back.
- Keep the page as static HTML with few outside resources, and tell visitors when you expect to return and how to reach you.
- Keep robots.txt crawlable. Google says a 503 on robots.txt itself blocks all crawling.
- Check the result with a tool such as curl, so you know the server really sends 503 and not 200 or 500.
Google also lists what not to do: do not block all crawling in robots.txt, do not return 403, 404 or 410, do not add noindex, and do not use the temporary removal tool in Search Console. Each of those tells Google to drop pages, not to wait.
Your options, from best to worst for this flaw
| Method | Removes PHP2Shell exposure? | Search impact for a short outage | Who does it |
|---|---|---|---|
| Host serves a static maintenance page at server level, 503 | Yes, if PHP is not reachable | Low, if kept to a day or two | Your host or developer |
| Patch PHP and stay online | Yes, this is the real fix | None | Your host or developer |
| Cloudflare or a similar firewall in front of the site | Partly, for known attack paths only | None | You or your developer |
| WordPress maintenance mode plugin | No, the page still runs on PHP | Low if it sends 503 | You |
| Delete the DNS record or let the domain stop resolving | Yes | High, and confusing for customers | You |
On firewalls: Help Net Security reported that Cloudflare deployed rules for the known PHP2Shell attack paths, including for free plan customers. That helps only if your site's traffic already goes through Cloudflare, and it does not cover new variants. PHP's advisory is clear that only an update is a complete solution.
Keep customers informed while you are down
- Put a phone number and email on the maintenance page. People who came to book or buy should still be able to reach you.
- Leave your Google Business Profile alone, apart from a short update post. Your hours, phone and directions still work while the website is down. Do not mark the business as closed; your shop is open, only the website is paused. Our Google Business Profile checklist shows where updates go.
- Pause paid ads that send people to the site. Paying for clicks to a maintenance page wastes money.
- Set a deadline. Agree with your host when the patch will be in. If it slips past two days, switch to a placeholder home page with a 200 status, as Google suggests for longer pauses.
Bringing the site back
- Confirm the fixed PHP version in writing, using how to check your PHP version.
- Check the site for signs of a break in before reopening it, with our first 24 hours checklist.
- Remove the maintenance page and make sure normal pages return a 200 status again.
- In Google Search Console, use URL Inspection on your home page and one or two key pages to ask Google to recrawl them.
Our take
Your host confirms the patch: do not take the site offline. The outage costs more than it saves.
No confirmation, simple brochure site with no logins or forms: we would chase the host hard for a few hours before going offline. The data at risk is small, but a hacked site can still be used to spread malware or spam under your name.
No confirmation, site with customer accounts, orders or forms: we would ask the host for a server level maintenance page with a 503 today, and set a two day limit for the patch.
Web designer looking after many sites: patch the sites with customer data first, and put a firewall in front of the rest while you work through the list.
Frequently asked questions
Will taking my website offline hurt my Google ranking?
A short outage of one or two days with a 503 status code and a Retry-After header is what Google recommends, and it is meant to avoid lasting damage. Longer full removals carry more risk, and Google says recovery has no fixed timeline.
Does a WordPress maintenance mode plugin protect against PHP2Shell?
No. The maintenance page from a plugin is still produced by PHP on the same server. PHP says the most serious form of the attack can run before any website code, so only a patch or a server level block helps.
What is a 503 status code?
It is the HTTP code for "service unavailable". It tells browsers and search engines the site is down temporarily, unlike 404 or 410, which say a page is gone.
How long can a site be down before Google drops it?
Google gives no exact number, but it describes full removal as acceptable only for a very short time, a few days at most, and suggests a placeholder page with a 200 status for anything longer than a day or two.
Should I use Search Console's removal tool while my site is down?
No. Google says not to use the temporary removal tool for closures, because it hides your pages from search results.
Sources
- Google Search Central: Temporarily pause or disable a website
- PHP: Security advisory, critical remote code execution vulnerabilities (October 21, 2026)
- Canadian Centre for Cyber Security: AL26-026 Critical vulnerabilities impacting PHP
- Central News Agency: Japan's Prime Minister urges PHP patching (Chinese)
- Help Net Security: PHP2Shell patched, update now
