Hacked, defaced, redirected, or just down? Forensic cleanup, blacklist removal, hardening, and a recovery plan so it doesn’t happen again.