Most people picture a hack as a defaced homepage with a message from whoever did it. That happens, but it is the exception. A compromise is usually built to stay quiet, because the longer it goes unnoticed, the more use the attacker gets out of it.
So the useful question is not “does my site look hacked?” It is “is my site behaving in ways I cannot explain?” These are the signs I look for first.
Redirects you did not set up
You (or a visitor) click through from a search result and land somewhere else entirely — an ad page, a sketchy store, a login prompt. Often it only triggers on mobile, or only from search, which is why the owner never sees it themselves.
New users, files, or scheduled tasks you did not create
An admin account you do not recognise, files with random names in wp-content or the site root, or a modified core file are all worth investigating. Attackers leave these behind so they can get back in even after the obvious infection is cleaned.
Warnings from Google or your host
A “this site may be hacked” label in search results, a browser warning, or a suspension notice from your host are late-stage signals. By the time these appear, the problem has usually been present for a while.
Strange behaviour and unexplained slowness
Spam pages appearing in search that you never published, email from your domain being marked as spam, or the site suddenly running slow can all point to malicious code running in the background.
The honest version
Any one of these can have an innocent explanation. Several of them together rarely do. If something feels off and you cannot account for it, the safe assumption is that the site needs a proper look — not a wait-and-see.