From a6cad7d9373108c76916166a43c7a0ba9b5befc1 Mon Sep 17 00:00:00 2001 From: Dinesh Yadav Date: Thu, 10 Sep 2026 13:54:38 +0530 Subject: [PATCH 1/7] Database: Send a 500 status and no-cache headers when using db-error.php or maintenance.php drop-ins --- src/wp-includes/class-wpdb.php | 10 +++++++++- src/wp-includes/functions.php | 4 ++++ src/wp-includes/load.php | 5 +++++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/src/wp-includes/class-wpdb.php b/src/wp-includes/class-wpdb.php index 869111efd0797..7802d91d2ff2c 100644 --- a/src/wp-includes/class-wpdb.php +++ b/src/wp-includes/class-wpdb.php @@ -1958,6 +1958,8 @@ public function flush() { * * @since 3.0.0 * @since 3.9.0 $allow_bail parameter added. + * @since 7.2.0 A 500 status header and no-cache headers are now sent + * before loading a custom db-error.php drop-in. * * @param bool $allow_bail Optional. Allows the function to bail. Default true. * @return bool True with a successful connection, false on failure. @@ -2009,8 +2011,14 @@ public function db_connect( $allow_bail = true ) { if ( ! $this->dbh && $allow_bail ) { wp_load_translations_early(); - // Load custom DB error template, if present. + /** + * Load custom DB error template, if present. + * A 500 status header and no-cache headers are now sent + * before loading a custom db-error.php drop-in. + */ if ( file_exists( WP_CONTENT_DIR . '/db-error.php' ) ) { + status_header( 500 ); + nocache_headers(); require_once WP_CONTENT_DIR . '/db-error.php'; die(); } diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php index 4c323812991d7..1591f588a5771 100644 --- a/src/wp-includes/functions.php +++ b/src/wp-includes/functions.php @@ -5634,6 +5634,8 @@ function wp_ob_end_flush_all() { * in WordPress 2.5.0. * * @since 2.3.2 + * @since 7.2.0 A 500 status header and no-cache headers are now sent + * before loading a custom db-error.php drop-in. * * @global wpdb $wpdb WordPress database abstraction object. * @@ -5646,6 +5648,8 @@ function dead_db() { // Load custom DB error template, if present. if ( file_exists( WP_CONTENT_DIR . '/db-error.php' ) ) { + status_header( 500 ); + nocache_headers(); require_once WP_CONTENT_DIR . '/db-error.php'; die(); } diff --git a/src/wp-includes/load.php b/src/wp-includes/load.php index 9d407453424c5..a26fa6c05f183 100644 --- a/src/wp-includes/load.php +++ b/src/wp-includes/load.php @@ -395,6 +395,8 @@ function wp_favicon_request() { * the wp-content directory). * * @since 3.0.0 + * @since 7.2.0 A 500 status header and no-cache headers are now sent before loading maintenance.php drop-in. + * This is to ensure that the correct headers are sent. * @access private */ function wp_maintenance() { @@ -404,6 +406,9 @@ function wp_maintenance() { } if ( file_exists( WP_CONTENT_DIR . '/maintenance.php' ) ) { + status_header( 503 ); + nocache_headers(); + header( 'Retry-After: 600' ); require_once WP_CONTENT_DIR . '/maintenance.php'; die(); } From f0ebb0e150728aa2b3c5da588b762d71660b7018 Mon Sep 17 00:00:00 2001 From: Dinesh Yadav Date: Fri, 11 Sep 2026 01:51:26 +0530 Subject: [PATCH 2/7] Update src/wp-includes/class-wpdb.php Co-authored-by: Weston Ruter --- src/wp-includes/class-wpdb.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/class-wpdb.php b/src/wp-includes/class-wpdb.php index 7802d91d2ff2c..036b2dadc1002 100644 --- a/src/wp-includes/class-wpdb.php +++ b/src/wp-includes/class-wpdb.php @@ -2014,7 +2014,7 @@ public function db_connect( $allow_bail = true ) { /** * Load custom DB error template, if present. * A 500 status header and no-cache headers are now sent - * before loading a custom db-error.php drop-in. + * before loading a custom db-error.php drop-in. */ if ( file_exists( WP_CONTENT_DIR . '/db-error.php' ) ) { status_header( 500 ); From bcd8e63ea6f10af9ee31432c469cebc31c1fdccf Mon Sep 17 00:00:00 2001 From: Dinesh Yadav Date: Fri, 11 Sep 2026 01:51:43 +0530 Subject: [PATCH 3/7] Update src/wp-includes/class-wpdb.php Co-authored-by: Weston Ruter --- src/wp-includes/class-wpdb.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/class-wpdb.php b/src/wp-includes/class-wpdb.php index 036b2dadc1002..7c12f9ef34d5e 100644 --- a/src/wp-includes/class-wpdb.php +++ b/src/wp-includes/class-wpdb.php @@ -1959,7 +1959,7 @@ public function flush() { * @since 3.0.0 * @since 3.9.0 $allow_bail parameter added. * @since 7.2.0 A 500 status header and no-cache headers are now sent - * before loading a custom db-error.php drop-in. + * before loading a custom db-error.php drop-in. * * @param bool $allow_bail Optional. Allows the function to bail. Default true. * @return bool True with a successful connection, false on failure. From 50f5e02cf24a79c03d37aceff07a5283eb9dfe8c Mon Sep 17 00:00:00 2001 From: Dinesh Yadav Date: Thu, 10 Sep 2026 22:13:17 +0000 Subject: [PATCH 4/7] Added suggestion to remove space for fixin phpcs issues. Fixed the status header for wp maintainance to change 500 to 503 in comment line --- src/wp-includes/class-wpdb.php | 6 ++---- src/wp-includes/functions.php | 3 +-- src/wp-includes/load.php | 4 ++-- 3 files changed, 5 insertions(+), 8 deletions(-) diff --git a/src/wp-includes/class-wpdb.php b/src/wp-includes/class-wpdb.php index 7c12f9ef34d5e..36f8e57278125 100644 --- a/src/wp-includes/class-wpdb.php +++ b/src/wp-includes/class-wpdb.php @@ -1958,8 +1958,7 @@ public function flush() { * * @since 3.0.0 * @since 3.9.0 $allow_bail parameter added. - * @since 7.2.0 A 500 status header and no-cache headers are now sent - * before loading a custom db-error.php drop-in. + * @since 7.2.0 A 500 status header and no-cache headers are now sent before loading a custom db-error.php drop-in. * * @param bool $allow_bail Optional. Allows the function to bail. Default true. * @return bool True with a successful connection, false on failure. @@ -2013,8 +2012,7 @@ public function db_connect( $allow_bail = true ) { /** * Load custom DB error template, if present. - * A 500 status header and no-cache headers are now sent - * before loading a custom db-error.php drop-in. + * A 500 status header and no-cache headers are now sent before loading a custom db-error.php drop-in. */ if ( file_exists( WP_CONTENT_DIR . '/db-error.php' ) ) { status_header( 500 ); diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php index 1591f588a5771..d58f8fe27f10f 100644 --- a/src/wp-includes/functions.php +++ b/src/wp-includes/functions.php @@ -5634,8 +5634,7 @@ function wp_ob_end_flush_all() { * in WordPress 2.5.0. * * @since 2.3.2 - * @since 7.2.0 A 500 status header and no-cache headers are now sent - * before loading a custom db-error.php drop-in. + * @since 7.2.0 A 500 status header and no-cache headers are now sent before loading a custom db-error.php drop-in. * * @global wpdb $wpdb WordPress database abstraction object. * diff --git a/src/wp-includes/load.php b/src/wp-includes/load.php index a26fa6c05f183..3782d1e7ac6a2 100644 --- a/src/wp-includes/load.php +++ b/src/wp-includes/load.php @@ -395,8 +395,8 @@ function wp_favicon_request() { * the wp-content directory). * * @since 3.0.0 - * @since 7.2.0 A 500 status header and no-cache headers are now sent before loading maintenance.php drop-in. - * This is to ensure that the correct headers are sent. + * @since 7.2.0 A 503 status header and no-cache headers are now sent before loading maintenance.php drop-in. + * to ensure that the correct headers are sent. * @access private */ function wp_maintenance() { From 4b13b9902687f3132f149a5776eb87829ea8b3f0 Mon Sep 17 00:00:00 2001 From: Dinesh Yadav Date: Mon, 14 Sep 2026 18:15:32 +0000 Subject: [PATCH 5/7] Standardize docblock phrasing for drop-in headers and parameters. --- src/wp-includes/class-wpdb.php | 4 ++-- src/wp-includes/functions.php | 2 +- src/wp-includes/load.php | 3 +-- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/src/wp-includes/class-wpdb.php b/src/wp-includes/class-wpdb.php index 36f8e57278125..3506555a68783 100644 --- a/src/wp-includes/class-wpdb.php +++ b/src/wp-includes/class-wpdb.php @@ -1957,8 +1957,8 @@ public function flush() { * If `$allow_bail` is false, the lack of database connection will need to be handled manually. * * @since 3.0.0 - * @since 3.9.0 $allow_bail parameter added. - * @since 7.2.0 A 500 status header and no-cache headers are now sent before loading a custom db-error.php drop-in. + * @since 3.9.0 Added `$allow_bail` parameter. + * @since 7.2.0 Added status and no-cache headers before loading a custom `db-error.php` drop-in. * * @param bool $allow_bail Optional. Allows the function to bail. Default true. * @return bool True with a successful connection, false on failure. diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php index d58f8fe27f10f..f3d74749a150c 100644 --- a/src/wp-includes/functions.php +++ b/src/wp-includes/functions.php @@ -5634,7 +5634,7 @@ function wp_ob_end_flush_all() { * in WordPress 2.5.0. * * @since 2.3.2 - * @since 7.2.0 A 500 status header and no-cache headers are now sent before loading a custom db-error.php drop-in. + * @since 7.2.0 Added status and no-cache headers before loading a custom `db-error.php` drop-in. * * @global wpdb $wpdb WordPress database abstraction object. * diff --git a/src/wp-includes/load.php b/src/wp-includes/load.php index 3782d1e7ac6a2..daa87aa427b8f 100644 --- a/src/wp-includes/load.php +++ b/src/wp-includes/load.php @@ -395,8 +395,7 @@ function wp_favicon_request() { * the wp-content directory). * * @since 3.0.0 - * @since 7.2.0 A 503 status header and no-cache headers are now sent before loading maintenance.php drop-in. - * to ensure that the correct headers are sent. + * @since 7.2.0 Added status and no-cache headers before loading a custom `maintenance.php` drop-in. * @access private */ function wp_maintenance() { From 11e1520a3d5ecfc7e811829af51efa195bac8136 Mon Sep 17 00:00:00 2001 From: Dinesh Yadav Date: Mon, 14 Sep 2026 18:42:15 +0000 Subject: [PATCH 6/7] Convert docblock to standard comment for custom db error template --- src/wp-includes/class-wpdb.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/wp-includes/class-wpdb.php b/src/wp-includes/class-wpdb.php index 3506555a68783..dcac704007cba 100644 --- a/src/wp-includes/class-wpdb.php +++ b/src/wp-includes/class-wpdb.php @@ -2010,10 +2010,10 @@ public function db_connect( $allow_bail = true ) { if ( ! $this->dbh && $allow_bail ) { wp_load_translations_early(); - /** + /* * Load custom DB error template, if present. * A 500 status header and no-cache headers are now sent before loading a custom db-error.php drop-in. - */ + */ if ( file_exists( WP_CONTENT_DIR . '/db-error.php' ) ) { status_header( 500 ); nocache_headers(); From 23d8f92cc8293ee397b9368df0771ec4e96aa471 Mon Sep 17 00:00:00 2001 From: Dinesh Yadav Date: Mon, 14 Sep 2026 21:49:46 +0000 Subject: [PATCH 7/7] Fix wp_maintenance() to send a 503 status. Move the require_once for functions.php before the maintenance file existence check so that status_header() is available to send a custom HTTP 503 status when maintenance mode is enabled. --- src/wp-includes/load.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/wp-includes/load.php b/src/wp-includes/load.php index daa87aa427b8f..71dc7d47df44e 100644 --- a/src/wp-includes/load.php +++ b/src/wp-includes/load.php @@ -404,6 +404,8 @@ function wp_maintenance() { return; } + require_once ABSPATH . WPINC . '/functions.php'; + if ( file_exists( WP_CONTENT_DIR . '/maintenance.php' ) ) { status_header( 503 ); nocache_headers(); @@ -412,7 +414,6 @@ function wp_maintenance() { die(); } - require_once ABSPATH . WPINC . '/functions.php'; wp_load_translations_early(); header( 'Retry-After: 600' );