Compromises are often quiet by design. These are the signals worth watching for.
VISIBLE SIGNS
Your site redirects visitors elsewhere, often only on mobile or only from search results. Pages you did not create appear, frequently selling pharmaceuticals, loans or replica goods. Spam links appear in your footer or between paragraphs, sometimes only visible to search engines. The homepage is defaced. Browsers or Google display a warning before your site loads.
LESS VISIBLE SIGNS
Administrator accounts you did not create. Files modified at times you were not working. Sort by Last Modified in File Manager. PHP files inside an uploads folder. Nothing legitimate puts them there. A sudden spike in bandwidth, CPU or outbound email. Your domain appears on an email blacklist. Search results for your site show unrelated keywords. Scheduled tasks in cPanel > Cron Jobs that you did not add.
IF YOU SUSPECT A COMPROMISE
Open a ticket immediately and run ImunifyAV from cPanel. Do not simply delete the visible symptom. A defaced homepage is usually the least important part of the problem, and the backdoor that allowed it will still be present.
