If visitors are redirected to strange domains, search results show spam pages you did not publish, or you cannot log into admin, treat it as a compromise.
Do not rush to wipe everything. Preserve evidence: note the time, take screenshots, and avoid overwriting logs until someone has reviewed them.
Contain first — change passwords from a clean device, revoke sessions, and temporarily restrict public write access if needed.
Then investigate malware and backdoors, restore from a known-clean backup, and close the entry point. Our threat investigation service follows that sequence.
