wilderness - 4:52 am on Jan 15, 2013 (gmt 0)

But now I need to know how to secure this so it can't happen again.

In any event, you'll still need to locate and coorect the PHP vulnerability

I'd be looking for a new host as part of the solution. It's possible they came in through your site, but don't discount the fact that they came in through the host.

The likelihood that your site (a mere five pages) was hacked
for its usefulness and quantity are pretty slim.