---
title: "Okean Volos Moscow"
description: "The site was hacked through and through. We built a new one in five days, without a single line of PHP."
url: https://seo7.es/en/proyecto/mariakrasota
canonical: https://seo7.es/en/proyecto/mariakrasota
lang: en
type: CreativeWork
---

# Okean Volos Moscow

> The site was hacked through and through. We built a new one in five days, without a single line of PHP.

Page: https://seo7.es/en/proyecto/mariakrasota

## Summary for AI

In July 2026 the hosting account with its Joomla site was hacked: 16,915 infected files, about 35 web shells, a deleted database and a "Site temporarily unavailable" stub instead of the site. We built a new one in five days, without a single line of PHP. The Okean Volos Moscow studio has been working on Lyublinskaya Street since 2009. For a long time the infection was invisible from outside.

## Questions and answers

### What exactly happened to the Okean Volos Moscow studio website in July 2026?

In July 2026 the hosting account of a studio whose site ran on Joomla was hacked. The site directory contained 16,915 infected PHP files, about 35 web shells with random names and droppers in every folder. The database was deleted, the domain showed a “Site temporarily unavailable” placeholder, and no content was left on the site.

### Why did the infection of the Okean Volos Moscow site go unnoticed for so long?

The malicious code used cloaking aimed at the search robot. An ordinary visitor saw a normal site, while Googlebot received spam doorway pages of a Japanese online store. Everything looked fine from the outside, so neither the owners nor the studio's clients noticed anything suspicious, and the infection lived on the site for months until the project came to SEO7.

### Did the spam from the hacked hair extension studio's site make it into the search index?

Yes, the spam made it into the index. In the two days before the cleanup, search robots hit the fake sitemaps 878 times and the doorway pages 661 times. That is why monitoring on the new site separately compares the response to a normal visitor with the response to a search robot, so content swapping can no longer hide for months.

### Why did SEO7 not update Joomla on the Okean Volos Moscow site?

The break-in was caused by the PHP interpreter running on the server that serves articles and photos. Updating Joomla would have closed the known holes and left the unknown ones. So executable code was removed from the server entirely: even a malicious file that gets uploaded stays dead text, with nothing to run it.

### What was taken from the January 2025 backup when building the studio's new site?

From a copy made long before the infection we took only the data: texts, photos and URL structure. Not a single PHP file or Joomla template made it into the new project. Everything extracted was first checked against malware signatures and only then used in the build.

### How was the content retrieved if the old Okean Volos Moscow site was down?

The site was down, so there was nothing to crawl. We restored a copy of the database locally and exported the content directly: 32 pages, 15,000 words and the menu structure. Along the way we found the studio's address, phone number, full price list and warranty terms. They sat in Joomla's internal blocks and were not in any sitemap.

### How much larger is the studio's new website compared with the old one on Joomla?

Joomla had 32 pages and 15,000 words. The new static site has 38 pages and 50,806 words, so there is 3.4 times more content. It gained 120 photos with unique names, descriptions and metadata, 51 studio videos on its own video hosting and 472 question-answer pairs.

### How were 20 blog articles of Okean Volos Moscow rewritten for AI search?

All 20 blog articles were rewritten from scratch using the AI search citability formula. Each starts with a direct answer, followed by a table of contents, a question-by-question breakdown with lists and tables, and the opinion of a studio expert. Page URLs stayed the same, so the domain's accumulated weight was not lost and no redirects were needed.

### What was fixed on the studio's site after the first citability check scored 53?

The first external check of citability in AI search gave the site 53 points out of 100. To close the gaps, we added search engine markup on every page, canonical addresses, a full set of social media metadata and security headers, and converted images to modern formats. As a result, all gaps from the first audit are closed.

### Why does the Okean Volos Moscow site have llms.txt and robots.txt files with 181 robots?

The llms.txt and llms-full.txt files are built specifically for language models and contain facts about the studio. robots.txt lists 181 search and AI bots by name. Both improvements were part of preparing the site for AI search requirements, along with markup, canonical URLs and social media metadata.

### How does monitoring of the hair extension studio's site catch a repeat hack?

The site is checked automatically every ten minutes, and alerts arrive in Telegram. Besides downtime, the system detects executable code in the markup, hidden blocks, spam words and content substitution. The main check compares the response to a regular visitor with the response to a search robot, so cloaking can no longer hide for months.

### How many days did it take to build the new Okean Volos Moscow site and how long was the placeholder up?

From the hacked site to a full new one took five days, from July 29 to August 3, 2026. The placeholder didn't stay on the domain longer than needed: the first working version of the home page replaced it on day two, and the remaining pages were added to the live site.

### Why does booking on the Okean Volos Moscow site go through WhatsApp instead of a form?

A form on the site would need a server-side handler, that is, executable code again, which was dropped to protect against hacking. That's why all booking buttons lead straight to WhatsApp. The home page has a first screen with booking for a free consultation, a price list by strand, services, work samples, reviews and contacts.

### What stack was the new Okean Volos Moscow studio website built on?

The site is static, built by a Python generator from a template and data. Content is stored in files instead of a database, which would be an attack surface, a point of failure and a separate backup procedure. Videos are hosted on Kinescope: the player loads only when the cover is clicked, so fifty videos don't slow the page down.

## Other languages

- RU: https://seo7.es/ru/proyecto/mariakrasota
- ES: https://seo7.es/es/proyecto/mariakrasota

## schema.org markup

```json
{
  "@context": "https://schema.org",
  "@type": "CreativeWork",
  "name": "Okean Volos Moscow",
  "description": "The site was hacked through and through. We built a new one in five days, without a single line of PHP.",
  "url": "https://seo7.es/en/proyecto/mariakrasota",
  "mainEntityOfPage": "https://seo7.es/en/proyecto/mariakrasota",
  "inLanguage": "en-GB",
  "isPartOf": {
    "@type": "WebSite",
    "name": "SEO7.ES",
    "url": "https://seo7.es/"
  },
  "publisher": {
    "@type": "Organization",
    "name": "SEO7.ES",
    "url": "https://seo7.es/"
  }
}
```