Thank you all, again, for your patience. As of late Saturday night, I can report that I believe all the necessary blocks are now in place to protect the web servers from direct access from the internet at large, and all the web servers hosting customer sites are up and running again (but not yet accessible from the internet, sorry!) I have spent quite a bit of time testing from outside the Servology network to ensure the blocks are working properly to keep the servers safe.
I have also made provisions to allow traffic from the WAF (Web Application Firewall) to reach the web servers, so tomorrow I will be starting the work of configuring domains to point at the WAF instead of the original servers and configuring the WAF in turn to route the traffic to the original servers after checking that it is not malicious.
If all goes to plan, I expect that customer sites will start to come online again from tomorrow (Sunday).