WordPress Security + Google Ads Destination Issue Specialist Needed

We operate a South Florida yacht services company and recently began experiencing Google Ads disapprovals related to our website destinations/sitelinks.
We need an experienced WordPress security and Google Ads specialist to identify the root cause.

Google appears to be flagging URLs/pages or domains that we do not recognize. We need someone who can determine whether our WordPress website has been compromised, contains injected code/pages/redirects, or has another technical issue causing Google Ads to flag our destinations.

Scope of work:
Perform a complete security audit of our WordPress website
Check for malware, injected pages, scripts, redirects and malicious code
Check WordPress database, files, plugins, themes and .htaccess
Review Google Search Console Security Issues and indexing
Review Google Ads disapproved destinations and sitelinks
Identify the exact URLs/domains triggering Google's warnings
Determine whether the issue is website security, redirects, indexing, or Google Ads configuration
Remove/fix the underlying issue
Verify the website using Google AdsBot/crawler testing
Assist with Google Ads re-review/appeal after the issue is corrected
Document exactly what was found and what was changed
Important: We are NOT looking for someone simply to delete the flagged URLs or change our ads. We want the underlying cause identified and permanently corrected.

Experience with WordPress security, Google Search Console, Google Ads policy/destination issues and hacked websites is required.
You will receive your own WordPress administrator account. We will not provide our GoDaddy account credentials.