I had the same problem. I’m also on GoDaddy for hosting. Thus far I changed the header to the correct code and it fixed my problem, but as others noted above, I may have other malicious code elsewhere. I don’t have any users that are admin that I did not make.