An attack ends and the graphs recover, but search engines kept their own record of the event. Crawlers visited while the site was timing out, and what they saw affects crawl behaviour and, if the outage was long enough, the index itself.
What Crawlers Do During an Outage
A well-behaved crawler treats server errors and timeouts as temporary and slows down, returning later. That is the good case: a brief outage usually costs crawl budget rather than rankings. The damage accumulates when the condition persists for days, or when the site answers in ways that suggest the page is gone rather than busy.
Status codes matter more than uptime
Answering 503 with a retry hint tells a crawler the page exists and is temporarily unavailable. Answering 404, or a 200 with an error page, tells it something very different — and the second message is much harder to undo.
The Protection Setting Nobody Checks
Aggressive challenge modes stop bots, and search crawlers are bots. Configure protection so that verified search engine crawlers are exempt from challenges, and then confirm it — not by reading the setting, but by fetching a page as the crawler and checking what comes back. A site that has been serving a challenge page to a search engine for a month has an indexing problem that looks nothing like a security problem.
Recovering Afterwards
- Check crawl statistics for the outage window and the days after, looking for a sustained drop in successful fetches.
- Fetch key pages as a crawler and confirm they return the page rather than an interstitial.
- Verify the sitemap is reachable and current, since that is how crawlers find what to revisit.
- Watch page experience metrics: an attack that leaves the site slow rather than down affects rankings through a quieter path.
The Compounding Cost
A short attack is an operational event. A repeated one becomes a reputation signal, both to customers and to ranking systems that reward reliability. The argument for filtering at the edge is not only that the site stays up during the attack; it is that the site never generates the sustained error history that takes months to work off.