Almost all of it is automated and indiscriminate. The same handful of measures stop nearly all of it, and most businesses are missing two or three of them.
The expensive part is rarely the website.
A compromised site can usually be cleaned in a day. What takes longer is the customer data that left with it, the search rankings that vanish while browsers flag you, and the conversation with the people whose details you were holding.
Under POPIA that last one is also a legal duty, with a deadline attached.
Most infections arrive through an old plugin or a reused password rather than a targeted attack. The signs are quiet: a slower site, files nobody recognises, or a customer mentioning that their browser warned them.
Software is patched constantly, and every patch is a public notice of what the older version could not withstand. Knowing what you run, and keeping it current, closes most of the gap on its own.
Names, numbers, addresses and order history are the part you cannot replace or apologise your way out of. Knowing exactly what you hold, where it sits and who can reach it is the first piece of work.
SSL is the baseline now, and a browser warning costs you visitors before anyone reads a word. Worth confirming it covers every address, renews on its own, and that nothing on the page still loads insecurely.
A firewall filters traffic you never wanted, and access control limits what a single compromised login can reach. Dormant staff accounts and shared passwords are the two most common findings.
A backup nobody has restored is a hope rather than a plan. What matters is how far back they go, whether they live somewhere separate, and how long it takes to get a working site out of one.
Every hour offline has a number attached, and it is worth knowing that number before you need it. The plan is short: who to call, what gets restored first, and what customers are told while it happens.
Most problems are cheap to fix early and expensive to find late. Uptime checks, file change alerts and a scheduled review turn a crisis into a Tuesday morning task.
From a look to a routine.
Hosting, platform, plugins, accounts, certificates and where customer data actually sits. Nothing changes at this stage.
A ranked list of what is wrong and what it would cost you, with the urgent separated from the merely untidy.
The work itself, by me or by whoever already looks after your site. Either way you get a written record of what changed.
Updates, backups and monitoring on a schedule, with a short report so you can see it is happening.