Most hacked WordPress sites don't look hacked. The home page loads, the contact form works, and nothing seems wrong. That's on purpose. The attacker earns money from your site's good name and traffic, so a site that keeps working is more useful to them.
What they usually do instead is add spam pages that only Google sees, send some visitors to scam sites, or create a hidden admin account so they can come back.
Here is what to check, in the order I would do it.
1. Search Google for site:yourdomain.com. Pages you never made, especially about pills, gambling or in a language you don't use, are the clearest sign.
2. Look for a warning. Google Search Console has a Security issues page. If Google found a problem, it tells you there first.
3. Check for redirects. Open your site on your phone, on mobile data, in a private window, and arrive from a Google search. If you land somewhere else even once, treat it as a hack.
4. Review your admin users. In the dashboard, go to Users and filter by Administrator. Every name should be someone you know.
5. Look for PHP files in the uploads folder. That folder should hold images and PDFs. A .php file in there almost never has a good reason to exist.
6. Notice what changed without you. Unknown plugins, a different site title, new draft pages, links in the footer you never added.
7. Listen to your host. A warning about "malicious files", or your email suddenly bouncing, often means your site is sending spam.
If you find a sign, don't start deleting. Take a full copy of the files and database first, so whoever cleans it can see how the attacker got in. Then change every password, and get the site cleaned properly.
The full guide covers all ten checks, the free tools to use, a five-minute monthly routine, and a real case where a scanner said "clean" and the site was not.
Read it here: How to check if your WordPress site is hacked
If you want me to look at a site you're unsure about, you can send it to me here.
