> Years ago, it was common to simply suspend the infected website until the webmaster finished the cleanup by themselves.

Which is still how it should be done.