Signs visitors see
- Redirects to pharmacy, gambling or 'your computer is infected' pages, sometimes only on phones or only from Google (so you may not see it when you type the address yourself).
- Pop-ups, ads or content you never added.
- A browser warning page before the site loads.
- A defaced homepage, or a site that is suddenly blank or showing errors.
- The site is extremely slow because it is being used to send spam or attack others.
Signs you see in your tools
- Google Search Console, Security Issues: Google tells you directly when it detects hacked content or malware.
- Search results: search site:yourdomain.com and look for pages in other languages, about products you do not sell, or with spammy titles. Hacked sites are often used to host thousands of hidden spam pages.
- Admin users: a new administrator account you do not recognize is a hack, every time.
- File changes: security plugins and hosts flag modified core files or new files in odd places.
- Email: your host warns about malware or outbound spam, or your domain's email starts landing in spam folders because the server is on a blocklist.
- Analytics: traffic from strange countries, or a drop after Google flags the site.
What to do
Do not just delete the suspicious files and hope. Take the site offline or into maintenance mode if it is actively harming visitors, change every password (hosting, admin, database, FTP, email), restore from a backup taken before the compromise if you have one, update everything, remove unknown users and plugins, and have the site scanned clean. Then find and close the hole, usually an outdated plugin, or it happens again within weeks. Finally, request a review in Search Console to remove Google's warning. The WordPress fixes page describes the clean-up service, is WordPress secure explains how sites get in this position, and good backups are what make recovery a one-hour job instead of a rebuild.