Protection of sites

On the website detected the iframe-paste that link to questionable websites or obfuscatory code.
Three websites on WP/ 2 landing.

the website on WP are under the selection of a login password. And did the permission to access admin panel only from one IP, play