Update just in case anyone else gets attacked by this.
I restored an earlier version of my website and made all available updates. I added the CleanTalk security plugin because I was using cleantalk for spam prevention for a long time and it’s worked great.
I then blocked access to my ISP and thought the site couldn’t get corrupted if no one could access the server.
Anyway, it was looking good, but when I checked this morning, I found the site corrupted again, the same way as before. The CleanTalk security plugin found two suspicious files. I’m going to check that out first. If CleanTalk can’t help, I’ll try Sucuri.