PHP2Shell: Taking Your Site Down? Google Says Use 503

If you take your site offline while PHP gets patched for the PHP2Shell flaws, make it return a 503 status code. Google's John Mueller gave that advice on October 21, 2026. The same day, OpenAI released a free checker that compares the PHP version a site exposes with the affected versions.

What we know

Google's advice: Mueller posted on Bluesky on October 21 at 15:26 UTC that anyone taking PHP sites down for unplanned updates should "use HTTP 503 instead of letting responses time out." He also said to avoid 404 and 500 responses, and that this can be done outside PHP, by pointing DNS elsewhere or at a CDN.
The guide he linked: Google Search Central's "Temporarily pause or disable a website" page (last updated December 10, 2025) says that if you need to disable a site urgently for one or two days, you should serve an informational error page with a 503 status instead of all content. Disabling a whole site is, in Google's words, an extreme measure for "a few days at most."
Technical details from that guide: don't return a 503 for robots.txt, because that blocks all crawling; use the retry-after header; serve static HTML. Google also warns that while a page returns 503, it can't refresh that page's titles, descriptions, metadata or structured data.
Why sites are going dark: according to TechCrunch, the US NSA advised taking sites offline if they can't be patched right away. PHP shipped the fixed versions on October 21 at 14:00 UTC.
OpenAI's checker: it's called php2shell-checker and is on GitHub under the Apache 2.0 license. It ships two Codex skills, phpcheck-url (when you only have the site's address) and phpcheck-server (when you have server access), plus a Node script you can run without Codex. It reads the PHP version from the X-Powered-By and Server headers, or from `php -v`, and sends no exploit traffic.
Its limits, per the repository itself: an OK result is only a version comparison and doesn't verify the fix. Headers can be hidden or changed, and distribution patches don't always change the version number. UNKNOWN does not mean the site is patched.

What changes and what doesn't

The fix is the same as before: update PHP on the server. What's new is guidance on how to pause a site without hurting how it appears in Google.

A 503 tells search engines the outage is temporary. A 404 says the page doesn't exist, and a 500 or a request that times out looks like a broken server. Google would rather a site stay online with limited features, but if you must take it down, a 503 is what its guide recommends.

One detail matters here. WordPress and Drupal maintenance modes also return a 503, but PHP itself generates that response: requests still reach the vulnerable software. That's why Mueller points to doing it outside PHP.

OpenAI's checker doesn't change anything on your site. It only reads what your server says about itself, and many servers don't say.

How to do it on your site

Try not to go offline. If your host has already rolled out the fixed PHP version, there's nothing to take down.
If you must, stop requests before PHP. With Cloudflare or another CDN, use a rule or maintenance page that returns 503. On your own server, an nginx or Apache rule that serves a static HTML page with a 503. On shared hosting, ask your provider whether they can put the site in maintenance with a server-level 503.
Leave robots.txt out of it. It should keep returning 200.
Add retry-after with an approximate time or duration.
Check it. `curl -I https://yoursite.com/` should return "503 Service Unavailable." You can also see it in your browser's developer tools, under Network → Status.
Keep it short. A few days at most. When you're back, check Search Console for server errors and crawl stats.
To see your version, `curl -I` shows the X-Powered-By header if your server sends it. OpenAI's checker does the same and compares it with the affected versions. If it says OK or UNKNOWN, confirm the version in your hosting panel or with your provider.

Sources

Updates: no changes since publication.