There are many things I expected to fight while developing GhoulStorm.
Zombies. Ghouls. Broken animations. Bugs that appear for no apparent reason. VR systems that work perfectly one day and mysteriously decide not to work the next.
But there was one enemy I definitely didn't put on the design document:
Hackers.
When I started working on GhoulStorm, I thought the nightmare was going to be waiting for me inside Hollow Hills Cemetery.
I was wrong.
The real nightmare was my website.
And, just to make things more interesting, it happened twice.
WHEN THE WEBSITE BECAME PART OF THE HORROR GAME
GhoulStorm is an independent project, which means that development is not only about creating the game itself.
There is modelling, texturing, animation, programming, VR testing, level design, sound, writing, website development, documentation...
And apparently, cybersecurity.
The first version of the GhoulStorm website was eventually compromised.
At that point, there was only one sensible thing to do:
Take it offline.
The website was removed from the server and the process of rebuilding began.
It was frustrating, but also a valuable lesson.
The game itself was never the problem. Development of GhoulStorm continued.
The website, however, had officially become another boss fight.
AND THEN IT HAPPENED AGAIN
After rebuilding the site, I thought the worst was behind me.
That sentence aged very badly.
The second version of the website was compromised as well.
At that point, I started to wonder whether Hollow Hills Cemetery was actually the safest place in the entire project.
At least the zombies announce themselves.
The hackers didn't.
The second incident made one thing very clear: simply rebuilding the website wasn't enough.
The underlying security and maintenance process needed to change too.
One of the important lessons was the need to keep Joomla, Page Builder and all other extensions properly updated. An outdated component can become a serious security risk, especially when it is exposed through a public website.
So the second rebuild wasn't going to be just another copy of the previous one.
It had to be done differently.
THE THIRD REBUILD
This time, I decided to change the entire approach.
Instead of building the website directly on the live server and hoping everything would behave, I rebuilt the project locally first.
That allowed me to work on the site in a controlled environment, test the structure, check the extensions and make changes without exposing an unfinished installation to the internet.
Only after the new version was ready was it uploaded to the live server.
This became the third GhoulStorm website.
Third time lucky?
Let's hope so.
Although, after two hacks, I'm trying not to tempt fate.
WHAT CHANGED?
The biggest change wasn't simply the visual design.
The new website was rebuilt with a much stronger focus on maintenance and security.
That means keeping the core software and extensions updated, reducing unnecessary components, making regular backups and testing changes before applying them to the live site.
The project is also backed up so that, if something goes wrong again, there is a way back.
Because discovering that your website has been compromised is already unpleasant.
Discovering that you have no recent backup is the part where the horror soundtrack really starts.
THE GAME NEVER STOPPED
One important thing I want to make clear is that these incidents affected the website, not the development of GhoulStorm itself.
While the website was being rebuilt, the game continued to evolve.
The work on the project continued across its different areas: 3D art, animation, VR systems, gameplay, environments and the overall experience.
The website is simply another part of presenting that work to the outside world.
So although the road to rebuilding the website was longer than expected, GhoulStorm itself never disappeared.
It was just temporarily accompanied by a second, completely unplanned horror story.
LESSONS FROM THE NIGHTMARE
Building an independent game already requires learning a huge number of different skills.
Building and maintaining the website adds another layer of responsibility.
These two incidents taught me several important lessons:
Keep everything updated
Joomla, extensions, templates and page builders all need regular updates.
Security isn't something you configure once and forget about.
Make backups
A backup is not particularly exciting when everything works.
It becomes extremely exciting when something doesn't.
Test before going live
Developing locally provides a safer environment for testing changes before they reach the public website.
Keep the installation as clean as possible
Every additional extension or component adds another element that needs to be maintained.
If something isn't necessary, there is a good reason to question whether it needs to be there.
Don't assume it can't happen
This may be the biggest lesson of all.
A website can look perfectly normal and still have a vulnerability somewhere underneath.
Security has to be treated as an ongoing part of development.
A NEW START FOR GHOULSTORM
After two security incidents and three website builds, the GhoulStorm website is finally back.
The new version represents more than just a redesigned website.
It represents a fresh start.
A cleaner development process.
A stronger focus on maintenance.
Better backup practices.
And, hopefully, fewer unexpected encounters with mysterious creatures hiding inside the server.
The goal now is simple:
Keep building the game.
Keep improving the website.
Keep documenting the journey.
And keep moving forward.
Because there are still plenty of things waiting for us inside Hollow Hills Cemetery.
And after everything that happened with the website, I'm starting to think the cemetery might actually be the easy part.
THE STORM IS STARTING AGAIN
GhoulStorm is still an independent project, still in development and still growing.
There will be more environments to build, more creatures to create, more gameplay systems to develop and plenty of problems to solve along the way.
Hopefully, most of those problems will now be the fun kind.
The kind involving zombies.
Not servers.
Not hacked websites.
And definitely not rebuilding everything for a fourth time.
For now, the website is back.
The development continues.
And the nightmare is waiting.
Welcome back to GhoulStorm.
The storm is starting again.
