↑
[email protected] 01245 922 335

php2shell and UpdraftPlus: how to fix your site without losing your Google rankings

Patching for php2shell or the UpdraftPlus breach? Here is how to do it without hurting your place in Google, and the Search Console checks to run afterwards.

Published
Author
SEO Essex
Reading time
3 min read

Two big website security problems landed in October 2026. You need to patch.

This guide covers the part that gets less attention: patching without damaging your Google rankings.

Two problems, one week

php2shell. PHP is the software behind most WordPress sites. It released fixes for two critical flaws in October 2026.

The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. (Search Engine Roundtable)

The UK's National Cyber Security Centre has published its own warning. (NCSC)

UpdraftPlus. The company behind this popular WordPress backup plugin found unauthorised access to its website over 17 to 18 October.

It released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which cut off the old connection keys. (TeamUpdraft)

Patching comes first. But how you patch matters for Google too.

Going offline the wrong way can cost you rankings

Some businesses took their sites down while they patched. That is a reasonable call.

The risk is how the site goes down. If Google visits and finds an error page or nothing at all, it can start dropping your pages.

Google's John Mueller gave clear advice during php2shell: use a 503 status ("temporarily unavailable"), not a timeout, a 404 or a 500. (Search Engine Roundtable)

A 503 tells Google "come back later". The others can look like the page has gone.

So what should you or your developer actually do?

Ask your developer these four questions

  1. Can we patch without going offline? Google recommends keeping a site up where possible. (Google)
  2. If we must go offline, will visitors and Google get a 503? Not a blank page, a 404 or a 500.
  3. Will robots.txt stay reachable? Google says not to serve a 503 for robots.txt, because that blocks all crawling. (Google)
  4. How long will it be down? Google says taking a whole site offline should only last a few days at most. (Google)

Never add "noindex" to hide a site while you fix it. Google says that removes your pages from Search.

Once the patch is in, the job is not quite done.

Check Search Console once you have patched

Google Search Console is free. If you have it set up, these checks take about ten minutes.

  • Security issues report. Google lists any hacked content or harmful code it has found on your site here. (Google)
  • Page indexing report. Look for a sudden jump in pages that are "not indexed". (Google)
  • URL Inspection. Test your homepage and your main service page. Check Google can fetch them. (Google)

Use UpdraftPlus? There is one more thing to look at.

UpdraftPlus users: look for anything you didn't add

TeamUpdraft asks users to check their sites for warning signs. (TeamUpdraft)

  • Users you don't recognise, especially new "editor" or administrator accounts.
  • Plugins you don't recognise, including the Must-Use tab.
  • Sites listed in UpdraftCentral that you didn't connect.

If Google finds hacked content on your site, it reports it in the Security issues report. (Google)

If you find any of this, deal with the security side first. Then run the Search Console checks above again.

Not sure where your site stands?

This is the kind of thing we check in a technical SEO review.

Want a second pair of eyes? Start with our free SEO audit, or get in touch.

Sources checked 26 October 2026. Security situations change quickly, so always check the original source for the latest advice.