Urgent WordPress Malware Cleanup

My WordPress site, www.whitebirchresort.net, keeps slipping medical-prescription links into random pages. The site was completely rebuilt just a year ago, yet the infection still resurfaces. I already run advanced security plugins, and when the spam links appeared I installed a couple more, but the problem persists. GoDaddy hosts the account on cPanel, and unfortunately I have no backups to roll back to.

I need every trace of the hack removed right away, with the site thoroughly scanned, cleaned, and hardened so it stays clean. Please be ready to track down hidden scripts or database injections, close whatever entry point they used, and set up a new backup routine I can rely on.

Deliverables I will check against:
• Clean site with no spam links or malicious code
• Written summary of what was found and fixed
• Security hardening steps applied (file permissions, firewall rules, plugin/theme audit)
• Simple automatic backup solution configured in cPanel or a trusted plugin

Time is critical, so let me know your estimated turnaround and any specific access you need beyond WordPress admin and cPanel.