The site is hardened and watched, with malware scanning running continuously and a firewall in front of it.
If a site is ever compromised we clean it up, as many times as it takes, provided the underlying issue is allowed to be patched. Repeat cleanups of the same unpatched issue, three or more times, are charged separately.
