A website that survived a hosting breach without a scratch.

vipstrizhkasobak.ru is the site of a dog-grooming studio in Moscow, rebuilt from scratch after its previous Joomla site was hacked. We picked a stack with nothing to break: plain PHP and JSON, no CMS, no database, no file uploads. Three weeks after launch the entire hosting account was breached, and that became a live test: not a single file of the site was touched.

Client: “ESTA” dog-grooming studio, Moscow, Izmailovo · Site: https://vipstrizhkasobak.ru · Category: website

The short version

• A stack with no holes. Plain PHP 8.3 plus JSON files. No CMS, no database, no file uploads.
• AI search engines found the site. In five days it was read by ChatGPT (37 visits), Perplexity and Claude. That is the GEO infrastructure working, not luck.
• The home page is served in 0.34 seconds and weighs 9.8 KB compressed.
• An interactive mascot instead of a pop-up: six states, eight animations, a contact menu on click.
• Integrity monitoring checks the site every half hour and messages the owner on Telegram.
• 89 price items and 30 breed pages the owner edits himself, with no developer involved.

Tech stack

• Backend: plain PHP 8.3, no framework.
• Data: JSON files, a database does not exist here as a concept.
• Front end: PHP templates, mobile-first responsive layout, Exo 2 typeface.
• Hosting: shared PHP hosting, deploy over SSH.
• Leads: a PHP handler, a write to JSON and an instant Telegram notification.
• Asset generation: rembg for background removal, fal.ai for image generation, PIL for normalisation, exiftool for metadata.
• Analytics: Yandex Metrica.

The client runs shared hosting with no Node on the server. So all the heavy work (cutting the dog out of a photo, generating the background, bringing 79 shots to one square, writing EXIF) was done locally in Docker containers, and only the finished result went to the server. Docker mirrors production: the same Apache, the same PHP, the same .htaccess. That way “works on my machine” and “works on the server” mean the same thing.

How it started

The studio’s previous site ran on Joomla and got hacked. A familiar story for an old CMS on shared hosting, where the engine and plugins had gone unpatched for years. Restoring an infected system made no sense: the same holes would bring the same problem back within a month.

The brief was blunt: build a site that physically cannot be broken into.

The old site still came in useful as a data source. We carefully pulled from it, read-only, 200 photographs, the full price list, a structure of 41 URLs, texts for 30 breeds and the legal documents. Not one line of foreign code made it into the new project.

Full list of what was built

🌐 Site and pages

• Home page hero: a cut-out dog on a generated background
• A studio block with a photo of the groomer, benefits, popular breeds, works, reviews, booking form
• Layouts for 375, 768 and 1024 pixels
• The header collapses into a single line on scroll
• Stepped interface zoom on wide monitors

🐕 30 breed pages

• A page per breed: package price, a “grooming, hygiene, spa” table, what the procedure includes
• Everything renders from a single JSON file, so a new breed is added from the admin panel in a minute

💰 89 price items

• A hub page with four cards and four sub-pages with tables
• 44 items for dogs (from 2,000 to 6,600 ₽), 3 for cats, 13 add-on services, 29 spa packages
• A price with a slash means a choice between clipping and stripping, which matters for wire-haired breeds
• The owner edits prices himself and changes show up instantly

🐩 Interactive mascot

• A drawn dog in the corner instead of the pop-up everyone closes unread
• Six states, micro-animation, eight random frame changes every eight seconds
• Lines such as “Package from 3,300 ₽, take a look at the prices”
• A click opens the menu: WhatsApp, Telegram, call, prices, booking

🛠 Admin panel

• Login with sessions and cross-site request forgery protection
• Dashboard, editing of contacts, prices and breeds, list of leads
• Atomic writes to JSON: two simultaneous leads never overwrite each other

📨 Leads and spam protection

• The form writes the lead to a file and sends it straight to the studio’s Telegram group
• A “slide to the right” control that works with a mouse, a finger and the keyboard
• A signed server-side token with a time check: submissions faster than three seconds or without a valid signature are rejected
• A hidden honeypot field for primitive bots

The real check lives on the server. A slider can be bypassed with a script; a signed token with a time check cannot.

🖼 Gallery and reviews

• 79 before-and-after works normalised to a single 600 × 600 square
• Reviews in three feeds (Yandex, WhatsApp, Avito) with stars drawn in code and mouse dragging
• 146 images, each carrying the studio’s EXIF data

📄 Legal documents

• Offer, privacy policy under Russian law 152-FZ, two data-processing consents, service rules
• Original texts written for this specific business, with the data controller’s details and the supervisory bodies
• Passport data is never published on the site

🔍 SEO

• A dynamic sitemap of 46 URLs that updates itself whenever the admin panel is used
• Schema.org markup on every page, canonical URLs, Open Graph, unique titles
• 301 redirects from every old Joomla URL, so accumulated page weight survived the move

🤖 GEO: optimisation for AI search

• llms.txt with a short description of the studio and a map of links
• llms-full.txt with the full content: contacts, all 89 price items, 30 breeds with prices
• robots.txt explicitly allows GPTBot, OAI-SearchBot, PerplexityBot, ClaudeBot and Google-Extended
• Both files are generated from the same data as the site, so they never go stale

⚡ Speed and security

• Compression, static caching, security headers, forced HTTPS
• Service folders closed to direct access
• PHP lifted from the dead 7.3 to a current 8.3.31

The breach the site never noticed

Three weeks after launch the hosting account went through a disaster. We tell it straight, because it is the best proof that the chosen stack was right.

What happened. Another site of the same client lived on that hosting account, an old Joomla. It was hacked on 26 June. On 25 July at 06:17:28 the attacker launched a mass infection of the account: within a minute 13 copies of the filefuns.php web shell, more than 20 replaced .htaccess files and two parasitic doorway domains the owner never created were spread across every folder.

The nastiest part sat in server memory. A process called php -f /tmp/httpd.conf took up residence there. It erased itself from disk right after start-up and ran in an infinite loop, recreating malicious files every 0.3 seconds. That is why the infection came back after every clean-up. The process lived for 12 days and could only be seen over SSH: processes are invisible over FTP.

What happened to our site. Nothing. We compared checksums of every project file against local reference copies and every single one matched. The infection dropped files next to the site but could not change anything inside it, because there was nothing to change: no CMS with vulnerable plugins, no database, no file uploads, no code execution. The web logs confirm that no intrusion attempt through the site ever succeeded.

How we cleaned it. We connected over SSH and found the resident process, invisible over FTP. We extracted the worm’s code straight from memory through /proc, since the file was already gone from disk, and got the evidence for the hosting provider. We killed the process, removed 13 backdoors, restored the original .htaccess files and deleted the two parasitic domains. Then we ran a signature scan across the whole account: 0 web shells, 0 obfuscated code, a clean scheduler. We handed the provider a report with exact timings, the process ID and the malware code.

What we did so it never repeats. We wrote an integrity watchdog that runs on the developer’s side rather than on the server: a watchdog that can be hacked together with the site is useless. Every 30 minutes the script logs in with a key, compares checksums of every file against the reference, looks for known backdoor names and obfuscated code, and checks the process list and the scheduler. Messages arrive on Telegram in two cases: when something changed, and once a day in the morning saying “all clean”. Verified by planting a test file: the alert arrives with the exact path.

A separate story about Installatron. Later, while the owner was deleting leftovers of old applications in the hosting panel, the built-in installer decided our site belonged to that installation too and wiped part of its files. The site was down for an hour and twenty minutes. We restored it in a minute by uploading the local project, because all the code is under version control and the deploy is reproducible. Leads and settings were untouched. The logs name the culprit plainly: the deletion requests came from Installatron Plugin at the server’s own address.

Results

AI assistants found the site

Server log data across five days, 14 to 19 August 2026:

ChatGPT-User visits mean real people asked the assistant about the studio and it went to the site for the answer. That is exactly what the GEO infrastructure was built for.

Classic search

Crawlers walk the breeds, the prices and the documents, correctly following the redirects from the old URLs. There are visits from the studio’s card on Yandex Maps.

PageSpeed Insights, report of 19 August 2026

Loading metrics: First Contentful Paint 0.8 seconds, Largest Contentful Paint 1.2 seconds, Total Blocking Time 10 milliseconds, Cumulative Layout Shift 0.001, Speed Index 1.0 seconds.

Technical figures