It has to be a combined effort. The hosting company is like the fire department - when your house is on fire they come through with axes and hoses because thei

It has to be a combined effort. The hosting company is like the fire department - when your house is on fire they come through with axes and hoses because their focus is saving lives, not property. When your site is being attacked, the hosting company focuses on stopping the attack, but you'll end up fixing a lot of security holes and patching code afterwards. For example, when I worked at Internet Brands, when several of our sites were attacked last year, our hosting company installed a Palo Alto firewall in front of our load balancer. It stopped the attacks overnight, but some sites became unbearably slow or unresponsive. It turns out that it was blocking some legitimate traffic (e.g. requests for RSS feeds for vBulletin forums, curl API requests). We had to go through hundreds of sites to look for things like this to patch.