A compromised website is usually discovered by somebody other than its owner. By the time a customer, a search engine warning or a browser interstitial tells you about it, the damage to traffic and reputation has already been done.
Monitoring exists to shorten that gap. It will not prevent a compromise, but it means you find out in hours rather than in weeks.
It is worth being clear about this, because most people assume a targeted attack. In practice the overwhelming majority of compromises are automated and opportunistic.
The practical conclusion is that keeping software current does more for your security than any product you can buy. Monitoring is the safety net, not the strategy.
A monitoring service crawls the site regularly and checks it against a range of indicators, combining its own scanning with external sources of malware and blocklist information. Between them these identify the common categories of compromise.
That last point matters more than it sounds. Being flagged by a search engine removes you from results and puts a warning page in front of anyone who tries to visit, and getting removed from a blocklist takes time even after the site is clean.
If a scan finds something, an alert goes out immediately with concise information about what was found and where, so that a decision about what to do next can be made quickly.
The value here is entirely in the speed. A site cleaned within a day of infection usually suffers no lasting search consequences. A site that has been serving malware for a month is a different problem.
Cleanup is partly automated but the majority of the work is done manually by an analyst who reviews the findings, identifies the anomalies and removes them. That is the correct approach, because automated removal alone tends to miss the backdoor that let the attacker in and the site is simply reinfected a week later.
A proper cleanup covers removing the malicious code, finding and closing the entry point, checking for additional administrator accounts that should not exist, and requesting removal from any blocklists the site has landed on.
If your site is hosted with us and you believe it has been compromised, raise a support ticket straight away. We can see server side evidence that is not visible from the outside, including file modification times and access logs, which usually identifies both the infection and the way in far faster than scanning the site externally.
We can also advise on monitoring and cleanup services, including arranging a third party specialist where a site needs one, and we will tell you honestly when the situation does not warrant paying for one.
Most of what actually protects a site costs nothing.
Keep the core software, plugins, themes and extensions updated, and treat this as routine maintenance rather than something done when convenient. Our fully managed plans exist partly because deferred upgrades are the single most common cause of the problems described above.
Beyond that: use strong, unique passwords with two factor authentication on admin accounts, remove accounts and plugins you no longer use rather than leaving them deactivated, and make sure you have backups you have actually tested restoring. A backup nobody has ever restored is a hope rather than a plan.