A 503 error, formally 503 Service Unavailable, is the HTTP status code a server returns when it is temporarily unable to handle a request, usually because it is overloaded or down for maintenance. It exists to tell browsers, crawlers and other software that the failure is expected to pass. A 404 says a page is missing. A 500 says something broke. A 503 says the server is alive enough to answer, cannot do the work right now, and expects to recover. Search engines, ad crawlers and content delivery networks (CDNs) all act on that promise.

What the specification says

The current definition sits in RFC 9110, the Internet Engineering Task Force (IETF) document on HTTP semantics published in June 2022. It describes 503 as indicating that the server "is currently unable to handle the request due to a temporary overload or scheduled maintenance, which will likely be alleviated after some delay." The server may attach a Retry-After header suggesting how long to wait.

Retry-After accepts either a number of seconds, such as Retry-After: 120, or an absolute HTTP-date, such as Retry-After: Wed, 21 Oct 2026 22:00:00 GMT. The header is advisory. Nothing in the specification obliges a client to honour it, and nothing obliges an overloaded server to send a 503 at all: the RFC notes that some servers will simply refuse the connection.

The specification also leaves 503 off the list of codes caches may store by default, so a CDN will not reuse one unless the server marks it cacheable.

How a 503 is produced

A 503 can be generated at several layers.

  • The application. A content management system in maintenance mode returns 503 for every page.
  • The web server or application server. When worker processes or connection pools run out, servers such as Nginx or a PHP-FPM pool answer with 503 rather than queue requests indefinitely.
  • The load balancer. When every server behind a load balancer fails its health check, the balancer returns 503 itself. The same happens during autoscaling lag, when traffic spikes faster than new instances can start.
  • The CDN or reverse proxy. Cloudflare's documentation distinguishes an origin-generated 503, which "occurs when your origin web server is overloaded," from a Cloudflare-generated 503, which "indicates a connectivity issue in a Cloudflare data center." The way to tell them apart, according to the same page, is whether the error page HTML contains the word "cloudflare".

From the outside these cases look identical, so a 503 in a crawl report does not reveal which layer refused.

Origin and evolution

The code dates from HTTP/1.0. RFC 1945, published in May 1996, defined 503 as meaning the server "is currently unable to handle the request due to a temporary overloading or maintenance of the server," adding that "the implication is that this is a temporary condition which will be alleviated after some delay." Retry-After existed at that point only in an appendix of additional, optional features.

RFC 2616, the HTTP/1.1 specification of June 1999, tied the two together. It allowed a 503 to carry Retry-After and instructed clients that, if no Retry-After was given, they should handle the response as they would a 500. RFC 7231, in June 2014, rewrote the HTTP/1.1 semantics, dropped that fallback instruction and removed 503 from the heuristically cacheable codes. RFC 9110 consolidated the definition in June 2022 for HTTP/1.1, HTTP/2 and HTTP/3. The wording has barely moved since. What changed is who listens.

Search engines turned it into an operational lever. On January 24, 2011, Google's Webmaster Central blog published guidance on planned downtime advising that it is "better to return a 503 HTTP result code" than a 404 or a 200 error page, and warning that "lasting 503s can eventually be seen as a sign that the server is now permanently unavailable." On March 26, 2020, Google's advice on pausing a business online repeated the point: a 503 for one or two days, a limited but indexable site for anything longer.

On February 17, 2023, Gary Illyes of Google warned site owners against using 403 or 404 responses to slow Googlebot, pointing them instead to 500, 503 or 429. When Google removed the Search Console crawl rate limiter on January 8, 2024, server responses became the main lever.

How Google and other crawlers treat a 503

Google's crawling documentation, last updated on February 4, 2026, groups 5xx and 429 responses together: they "prompt Google's crawlers to temporarily slow down with crawling." For Google Search, "already indexed URLs are preserved in the index, but eventually dropped." Once 2xx responses return, crawling gradually recovers. The page does not distinguish 503 from 500 or 502.

On November 20, 2025, Google updated its crawling infrastructure documentation to state that the slowdown applies to the entire hostname and that serving errors for more than one to two days may hurt how a site appears in Google products. In early October 2026, Google added Retry-After to its crawl rate guidance. "When returning a 503 or 429 status code, you can also include a Retry-After HTTP header," the page now says, according to Barry Schwartz of Search Engine Roundtable, who reported the change on October 6, 2026. Google's changelog says support for the header "is not new."

The robots.txt file is the sharpest edge. Under Google's robots.txt specification, a 5xx response to that single file, with 503 given as the typical case, causes Google to stop crawling the whole site for the first 12 hours while it retries. After that it uses the last cached copy for up to 30 days. Google's pause guidance puts it bluntly: returning a 503 for robots.txt "blocks all crawling."

Recovery is slower than the outage. At Search Central Live in Barcelona, which ended on October 2, 2026, Cherry Prommawin of Google explained that 429 and 5xx codes feed a host load limit shared by Google's crawlers, according to a recap by John Campbell, and crawl capacity can take one to three weeks to recover after Google backs off. The Search Console Crawl Stats report, rebuilt in November 2020, shows these events under host status and response code, as the crawl budget explainer sets out.

Why it matters for advertising

Landing pages. Google Ads uses its AdsBot crawler to check destinations. Its "Destination not working" policy lists 5xx responses among the HTTP errors that lead to disapproval, and asks for a 200 response globally. The page makes no exception for 503, so a maintenance window can take ads offline.

Shared infrastructure. Ad servers, measurement tags and clean rooms run on a small number of clouds and CDNs. The AWS outage of October 19 and 20, 2025, caused by a DNS failure in the US-EAST-1 region, affected 142 AWS services over about 15 hours, including ad products built on AWS Clean Rooms. On November 18, 2025, an oversized Bot Management configuration file crashed Cloudflare's core proxy and produced widespread 5xx errors for roughly three hours. Matthew Prince, Cloudflare's chief executive, called it the company's worst outage since 2019.

Bot load. AI crawlers have become a cause of 503s, not just a recipient. Kinsta data showed one AI crawler hitting a single WordPress cart page 3.75 million times in a day, exhausting PHP workers that serve customers.

Programmatic auctions. In OpenRTB, the protocol behind real-time bidding, a bidder declines with an HTTP 204 No Content response, and the exchange sets a tmax field giving the maximum milliseconds it will wait. A bidder that answers with 503, or too late, simply loses the auction. Repeated failures give exchanges a reason to send that bidder less traffic. OpenRTB itself defines no special handling for 503.

Limitations and disputes

Equivalence with 500. Google's documentation treats 500, 502 and 503 alike for crawling. Practitioners often call 503 the "correct" maintenance code, but Google's pages give it no special treatment beyond the Retry-After pairing.

Retry-After is a request, not a rule. Cloudflare's trust scores for Verified bots, announced on October 16, 2026, reward bots that slow down after 429 responses, but say nothing about 503 or Retry-After specifically.

Misuse for removed content. A page that is gone for good should return 404 or 410. Serving 503 indefinitely keeps the URL in limbo until Google drops it anyway.

The time limit is vague. Google's pages variously say one to two days or "a few days at most" before harm sets in. None gives a precise threshold.

How 503 differs from adjacent terms

  • 500 Internal Server Error signals an unexpected fault, with no promise of recovery. Google slows crawling for both.
  • 502 Bad Gateway comes from a proxy that received an invalid response from upstream. 504 Gateway Timeout comes from a proxy that received no timely response. Both point to the origin; a 503 may come from the origin itself.
  • 429 Too Many Requests, created by RFC 6585 in April 2012, is a client error aimed at a specific requester exceeding a rate limit. A 503 describes the server's state for everyone.
  • Soft 404 is the opposite failure: a page that returns 200 while displaying an error. Google's documentation says Search Console flags such pages as soft 404s.

Recent developments

October 2026 brought the code back into focus. Beyond Google's Retry-After update, on October 5 the Wikimedia Foundation said automated activity it attributes to OpenAI, including millions of API requests and crawled pages, may have contributed to a partial service disruption in May. Cloudflare's Verified bot trust scores followed on October 16, making compliance with back-off signals a factor in whether a crawler is let through.

Timeline

  • May 1996 - RFC 1945 defines 503 Service Unavailable for HTTP/1.0.
  • June 1999 - RFC 2616 links 503 to the Retry-After header.
  • January 24, 2011 - Google publishes guidance recommending 503 for planned downtime.
  • April 2012 - RFC 6585 creates 429 Too Many Requests.
  • June 2014 - RFC 7231 revises 503 and removes it from heuristically cacheable codes.
  • March 26, 2020 - Google advises a 503 for closures of one to two days.
  • November 2020 - Google relaunches the Search Console Crawl Stats report with host status.
  • June 2022 - RFC 9110 becomes the current definition.
  • February 17, 2023 - Google warns against 403 and 404 for rate limiting and points to 500, 503 and 429.
  • January 8, 2024 - Google removes the Search Console crawl rate limiter.
  • October 19-20, 2025 - AWS US-EAST-1 outage affects 142 services.
  • November 18, 2025 - Cloudflare's worst outage since 2019 produces widespread 5xx errors.
  • November 20, 2025 - Google says 500, 503 and 429 slow crawling for the whole hostname.
  • February 4, 2026 - Google's HTTP status code documentation last updated.
  • October 5-6, 2026 - Google adds Retry-After guidance to its crawl rate page.
  • October 16, 2026 - Cloudflare introduces trust scores for Verified bots.

Summary

Who. Web servers, applications, load balancers and CDNs send 503 responses; browsers, search crawlers, ad crawlers, bidders and AI bots receive them. The IETF defines the code, and Google, Cloudflare and other platforms document how they react to it.

What. HTTP 503 Service Unavailable is a server error status code meaning the server cannot handle the request right now because of overload or maintenance, optionally with a Retry-After header saying when to return.

When. It was defined in RFC 1945 in May 1996, linked to Retry-After in RFC 2616 in June 1999, revised in RFC 7231 in June 2014 and is currently specified by RFC 9110 of June 2022. Google added explicit Retry-After guidance to its crawl rate documentation in October 2026.

Where. It is returned at the application, web server, load balancer or network edge, on any resource fetched over HTTP, from article pages and landing pages to robots.txt and bid endpoints.

Why. Servers need a way to say "not now" that is distinct from "not here" or "broken". For publishers and advertisers, the code determines whether search engines keep pages indexed through an outage, how fast crawlers return, and whether ad platforms approve landing pages.