The hoster blocked the site for phishing, what should I do?

Question

Phishing

Hello, my hoster blocked the site for phishing, it looks like the site was hacked in some way unknown to me. Site on joomla.
Here is what the hoster wrote:
- perform a full audit of the execution of the code (scripts) of the site for the presence of the main types of vulnerabilities and eliminate them
› SQL injections
› PHP injections
› CRLF injections
› LDAP injections
› Remote File Include (RFI) - inclusion of a remote file
› Local File Include (LFI) - local file inclusion
› XSS - cross-site scripting
› CSRF - cross-site request forgery
› File Upload - ability to upload arbitrary files to the server
› Site administration panel authorization bypass
› Information Leakage - information leaks
› Other script execution errors,
if necessary, contact third-party specialists for this
- update all CMS and modules, remove / disable unused
ones - check cPanel account for viruses with built-in antivirus
- change cPanel password to a more complex
one - check local machines from which it comes work with an account for viruses.
Who will tell you where it can be fixed inexpensively, etc. I don't understand myself.

Answer 1

freelansim.ru
well, there is https://habrahabr.ru/post/303956/

Answer 2

for the picture

position: absolute;
top: 0;
left: 0;
right: 0;
bottom: 0;

for parent
position: relative;