We cleared the infected files, hardened the site and moved it to hosting where core, theme and plugin updates happen on a schedule. Removing the site-wide noindex made every page eligible to rank for the first time. Installing analytics and conversion tracking meant the following months would produce a baseline, which the previous years never had.