How do I approach website security hardening after a hack?

Hey everyone, I've been lurking and reading some of the discussions here, especially the one about the persistent malware redirects, and honestly, it's pretty terrifying to hear about. I'm really new to the deeper aspects of website security, and I just wanted to ask for some guidance because I'm in a bit of a panic after dealing with something similar myself. I've just managed to clean up a nasty redirect malware on my small SaaS site, or at least I think I have, and while the immediate threat might be gone, I'm absolutely terrified it will happen again. It was such a stressful experience, and the thought of going through it all over is making me lose sleep. The core problem is that I don't really understand how the initial infection happened in the first place, and I'm completely overwhelmed by all the advice out there on how to prevent future attacks. I really want to make sure my site is truly secure moving forward, especially since it's a SaaS and customer data is involved, even if it's just basic user info for now. I'm looking for some detailed, actionable steps for a complete beginner like me on how to approach 'website security hardening' specifically after a malware incident. What are the absolute essential first steps for security hardening right after a malware cleanup? I'm worried I'll miss something obvious or crucial. Also, are there specific areas like file permissions, database security, or maybe less obvious server configs that beginners often miss when they're trying to secure their site? Everything just seems so complex when you're starting out. Could anyone recommend any beginner-friendly tools or services for ongoing vulnerability scanning or intrusion detection? I'm willing to invest a little if it means peace of mind and better protection. And finally, how important is a Web Application Firewall (WAF) for a small SaaS like mine, and which ones are generally considered easy to set up for someone who isn't a security expert? Any 'dummy-proof' advice or resources for someone trying to get a handle on proper server hardening and overall website security would be incredibly helpful.