Okean Volos: website after a hack

In July 2026 the hosting account of a studio whose site ran on Joomla was hacked. The site directory contained 16,915 infected PHP files, about 35 web shells with random names and droppers in every folder. The database was deleted, the domain showed a “Site temporarily unavailable” placeholder, and no content was left on the site.

The malicious code used cloaking aimed at the search robot. An ordinary visitor saw a normal site, while Googlebot received spam doorway pages of a Japanese online store. Everything looked fine from the outside, so neither the owners nor the studio's clients noticed anything suspicious, and the infection lived on the site for months until the project came to SEO7.

Yes, the spam made it into the index. In the two days before cleanup, search robots hit the fake sitemaps 878 times and the doorway pages 661 times. The scale of the infection was increased by a second, long-abandoned Joomla installation on the same hosting, which held another 25,874 files.

The break-in was caused by the PHP interpreter running on the server that serves articles and photos. Updating Joomla would have closed the known holes and left the unknown ones. So executable code was removed from the server entirely: even a malicious file that gets uploaded stays dead text, with nothing to run it.

From a copy made long before the infection we took only the data: texts, photos and URL structure. Not a single PHP file or Joomla template made it into the new project. Everything extracted was first checked against malware signatures and only then used in the build.

The site was down, so there was nothing to crawl. We restored a copy of the database locally and exported the content directly: 32 pages, 15,000 words and the menu structure. Along the way we found the studio's address, phone number, full price list and warranty terms. They sat in Joomla's internal blocks and were not in any sitemap.

Joomla had 32 pages and 15,000 words. The new static site has 38 pages and 50,806 words, so there is 3.4 times more content. It gained 120 photos with unique names, descriptions and metadata, 51 studio videos on its own video hosting and 472 question-answer pairs.

All 20 blog articles were rewritten from scratch using the AI search citability formula. Each starts with a direct answer, followed by a table of contents, a question-by-question breakdown with lists and tables, and the opinion of a studio expert. Page URLs stayed the same, so the domain's accumulated weight was not lost and no redirects were needed.

The first external check of citability in AI search gave the site 53 points out of 100. To close the gaps, we added search engine markup on every page, canonical addresses, a full set of social media metadata and security headers, and converted images to modern formats. As a result, all gaps from the first audit are closed.

The llms.txt and llms-full.txt files are built specifically for language models and contain facts about the studio. robots.txt lists 181 search and AI bots by name. Both improvements were part of preparing the site for AI search requirements, along with markup, canonical URLs and social media metadata.

The site is checked automatically every ten minutes, and alerts arrive in Telegram. Besides downtime, the system detects executable code in the markup, hidden blocks, spam words and content substitution. The main check compares the response to a regular visitor with the response to a search robot, so cloaking can no longer hide for months.

From the hacked site to a full new one took five days, from July 29 to August 3, 2026. The placeholder didn't stay on the domain longer than needed: the first working version of the home page replaced it on day two, and the remaining pages were added to the live site.

A form on the site would need a server-side handler, that is, executable code again, which was dropped to protect against hacking. That's why all booking buttons lead straight to WhatsApp. The home page has a first screen with booking for a free consultation, a price list by strand, services, work samples, reviews and contacts.

The site is static, built by a Python generator from a template and data. Content is stored in files instead of a database, which would be an attack surface, a point of failure and a separate backup procedure. Videos are hosted on Kinescope: the player loads only when the cover is clicked, so fifty videos don't slow the page down.