Originally published on the Bug Circuit blog.
If your site shows a browser warning, redirects visitors somewhere strange, has admin accounts you didn't create, or your emails are suddenly bouncing, treat it as hacked until you've checked and ruled it out. None of these signs alone is proof, but two or more together is a strong signal.
This is for any small business owner, freelancer, or agency running a WordPress site, Shopify store, or small SaaS app who's noticed something "off" and wants to know if it's a hack or a glitch. You'll get a plain-English checklist of the 12 most common symptoms, what each one actually means, how urgent it is, and the exact first steps to take.
Quick-scan checklist
Run down this table first. Anything in the Critical or High row means stop reading and act now — jump to "What to do right now" below.
