If the site is small enough, then I’d strongly suggest re-creating from scratch.
Once hacked, you never know what gremlins are lurking in the code that will surface again at some point.
I tried to fix a hacked site six months ago using the Securi stite check. It got rid of most of the nasties, but a month later the hackers were back.