Google clarified several technical search signals in the week ending Oct. 24, 2026. The lead item was a Search Central reminder on 503s, posted Oct. 21 as PHP shipped emergency fixes for two critical flaws, according to the weekly SEO Pulse roundup.
At a glance
| Company | |
|---|---|
| PHP emergency fixes | 2026-10-21, two critical flaws |
| Maximum advised 503 period | 1-2 days |
| Cloudflare pilot scope | About 1% of Cloudflare's network |
| New pages found for OpenAI | Hundreds of millions |
| Google-supported image formats | BMP, GIF, JPEG, PNG, WebP, SVG, AVIF |
The signal
- Google Search Central told site owners on Oct. 21 to serve a 503 status code, not a 404 or an error page with a 200, when taking servers offline for PHP patches.
- Keep any 503 to 1-2 days at most, and keep robots.txt answering normally, because a 503 on that file blocks all crawling.
- Robots.txt only controls which paths compliant crawlers may fetch, so use Google-Extended for Gemini use of content and separate OpenAI crawler rules such as OAI-SearchBot and GPTBot.
- Pick one form of square brackets in URLs and use it in links, canonicals, sitemaps and structured data, and keep a Google-supported format such as JPEG, WebP or AVIF in the img src, since Google Images and Discover previews do not support JPEG XL.
What happened
Google Search Central used a LinkedIn post to tell anyone taking servers offline for PHP patches to return a 503 status code. It warned against generic 404s and against error pages served with a 200. The PHP flaws can let attackers run code without logging in. SEJ's coverage of the PHP vulnerabilities advised owners to press their hosts to apply the fixes right away. On Bluesky, John Mueller added that the 503 does not need to come from PHP. A CDN or a DNS change pointing elsewhere can serve it instead. Google's crawl-rate documentation says 500, 503 and 429 responses slow crawling across the entire hostname. It also warns against serving them for longer than 1-2 days.
Gary Illyes said in an Oct. 21 Search Central video on robots.txt that RFC 9309 only governs which paths compliant crawlers may fetch. It says nothing about how content is used once crawled. A summary of the Illyes video notes that Google's parser reads just four rules: user-agent, allow, disallow and sitemap. It silently ignores any other line. Coverage of Google's new robots.txt video adds that Illyes recommends percent-encoding non-English paths in the file. Separately, Cloudflare and OpenAI said in an Oct. 15 post that a research pilot helped OpenAI find and index hundreds of millions of new pages for ChatGPT. The pilot drew on roughly 1% of Cloudflare's network. Its signals help the crawler skip missing pages and spot updated ones. The post gave no figures on how often the new pages are cited or how much traffic they send.
On Oct. 19, Mueller said on Bluesky that raw square brackets and their %5B and %5D encodings form different URLs under RFC 3986. He conceded he had probably answered this wrongly in the past. When both versions return identical content, Google crawls each one, removes the duplicate and keeps one. On Oct. 15, he said Google Images and Discover previews do not support JPEG XL. Chrome 155 and Firefox 158 now display the format. Google CEO Sundar Pichai told Alex Heath on the Sources podcast that AI agents will reach sites by browsing pages and through protocols. He expects protocols to scale far better but take longer to develop, and he pointed to the Universal Commerce Protocol.
By the numbers
Watch
Timeline
Google began a wide rollout of JPEG XL support in Chrome 155.
Firefox 158 added JPEG XL support.
Cloudflare and OpenAI published their pilot post, and Mueller said JPEG XL is unsupported in Google Images and Discover previews.
Mueller said raw and percent-encoded brackets create different URLs.
PHP released emergency fixes, Google Search Central posted its 503 reminder, and Illyes published the robots.txt video.
The SEO Pulse roundup of the week's Google clarifications was published.
“Serving a 503 (Service Unavailable) HTTP status code ensures already indexed URLs are preserved in Search while you work.”
How to handle PHP patch downtime with a 503
- 1Serve a 503
Return a 503 status code, not a 404 or an error page with a 200, while servers are offline for PHP patches.
- 2Use something that stays up
The 503 can come from a CDN routing rule or a temporary server that DNS points to, because PHP itself is down.
- 3Keep robots.txt normal
A 503 on the robots.txt file blocks all crawling, so that file should keep answering normally.
- 4Add Retry-After if useful
A Retry-After header on a 503 can tell Google's crawlers when to try again.
- 5Limit the time
Google advises against serving a 503 longer than 1-2 days, and suggests an indexable home page with a 200 for longer closures.
Why it matters
Each signal has a narrower reach than many teams expect. During planned downtime, the 503 has to come from something that stays up while PHP is down, such as a CDN routing rule or a temporary server. A Retry-After header can tell Google's crawlers when to return. Robots.txt should keep answering normally, because a 503 on that file halts all crawling. Brief 503s of 10-15 minutes now and then are fine, according to Illyes. For closures longer than a day or two, Google's pause guide suggests an indexable home page served with a 200. Sites on PHP 8.1 or older no longer receive regular official updates. PHP has published limited source fixes for versions 7.4 through 8.1.
For AI use, blocking crawl paths is not the same as opting out of training. Google-Extended controls whether Google may use crawled content for Gemini training and grounding. It does not affect Search inclusion. OpenAI separates its crawlers, so a site can allow OAI-SearchBot while disallowing GPTBot. Google-Agent, the fetcher Google's hosted agents use, generally ignores robots.txt. On URLs, teams should choose one bracket form and apply it across links, canonicals, sitemaps and structured data. For images, the img src should point to a format listed in Google's image SEO documentation. JPEG XL can be offered as a picture source with a JPEG, WebP or AVIF fallback, and og:image should use a listed format.
Who is affected
| Who | What changes | Impact |
|---|---|---|
| Site owners patching PHP | Must serve a 503 from outside PHP, keep robots.txt reachable and keep downtime to 1-2 days. | High |
| Teams managing AI crawler rules | Robots.txt controls crawling, not later use. Google-Extended covers Gemini use, and OpenAI crawlers need separate rules. | Medium |
| Technical SEO and web teams | Should pick one bracket URL form across links, canonicals, sitemaps and structured data, and keep a supported format in the img src. | Medium |
What to do now
For marketers
- Ask your web team this week for a written plan to serve a 503 during any planned downtime, and confirm who owns it.
- Pick one form of square brackets for your URLs, then check that links, canonicals, sitemaps and structured data all use it.
- Review your robots.txt rules crawler by crawler, and decide separately which crawlers may fetch pages for search and which may not.
- Check that the img src, og:image and image markup on key pages point to a format Google Images supports, not JPEG XL.
- Do not assume that being found by an AI crawler brings citations or visits, and track referral traffic before you shift budget.
For software buyers and IT teams
- Ask your host or vendor when emergency PHP fixes will be applied to your servers, and get the answer in writing.
- Set up the 503 response on a layer that stays up while PHP is down, such as a CDN rule or a temporary server.
- Test that robots.txt keeps answering normally while the rest of the site returns a 503.
- Add a Retry-After header to the 503, set an end time for the downtime, and plan a placeholder page in case work runs long.
- Check which PHP versions your sites run, and ask your host or support vendor how older versions will be patched.
Printable, one page, 17 checks. Enter your email and it opens right away.
We email you a copy. We never share your email and never send you sales emails.
Pick one. It takes 5 seconds and helps more people find these briefings. Your checklist opens straight after.
Have a work email? Use it instead and the checklist opens straight away.
Open it, then save it as a PDF or print it.
Know someone who would find this useful?
These steps are our recommendations based on this news, not statements from the companies involved.
What to watch
- An IETF draft co-written by Illyes would add a Content-Usage rule to robots.txt, but it remains a working group document without approval.
- Whether Cloudflare and OpenAI release data on citations or visits from pages the pilot surfaced; the post says discovery does not guarantee a citation.
- How non-Google crawlers and fetchers treat bracket URLs, since Mueller said some may handle them less precisely than Google.
Questions readers ask
What status code should I serve when I take my site offline for PHP patches?
Serve a 503 (Service Unavailable) status code. Google Search Central said on Oct. 21 that a 503 keeps already indexed URLs preserved in Search while you work, and it warned against generic 404s or error pages served with a 200.
How long can I serve a 503 before it hurts my Google indexing?
Google recommends serving a 503 for no longer than 1-2 days. If Googlebot sees these codes on the same URL for multiple days, the URL may be dropped from the index.
Where should the 503 come from if PHP is the thing being patched?
It should come from something that stays up while PHP is down, such as a CDN routing rule or a temporary server your DNS points to. Keep robots.txt answering normally, because a 503 on that file blocks all crawling.
Does robots.txt stop AI companies from using my content?
No. Robots.txt only controls which paths compliant crawlers may fetch, and it does not control how content is used after it is crawled. Use Google-Extended to manage Gemini use, and set separate rules for OpenAI crawlers, such as allowing OAI-SearchBot while disallowing GPTBot.
Are raw and percent-encoded square brackets the same URL for Google?
No. John Mueller said raw brackets and their %5B and %5D forms are different URLs under RFC 3986. If both return identical content, Google crawls each, removes the duplicate and keeps one, so pick one form and use it in links, canonicals, sitemaps and structured data.
Does Google Images support JPEG XL?
No. Mueller said on Oct. 15 that Google Images and Discover previews do not support JPEG XL, even though Chrome 155 and Firefox 158 now display it. You can offer it as a picture source while keeping a JPEG, WebP or AVIF file in the img src.
Will the Cloudflare and OpenAI pilot get my pages cited in ChatGPT?
No. The pilot helped OpenAI find hundreds of millions of new pages, but the post says discovery does not guarantee a citation. It also gave no figures on how often those pages are cited or how many visits they send.
Companies in this story
Sources
- dailyseobrief.comOriginal
- pageradar.ioOriginal
- Google for DevelopersOriginal
- Google for DevelopersOriginal
- Search Engine Journal
- searchenginejournal.com
- searchenginejournal.com
- Search Engine Journal
- Search Engine Journal
- Search Engine Journal
- Google Search Central
Researched, fact-checked and edited by the Market Signal desk. Read our editorial standards. Spotted an error? Email hello@webvisiblity.com and we will correct it.