Been cleaning infected WordPress sites for a while now, and the same three warning signs come up over and over. Most owners don't catch them until Google or their host does it for them.

1. Weird admin users you didn't create. Check Users → All Users right now. Attackers often create a hidden admin account as a backdoor, sometimes with a username that looks legit (e.g. "wp_support").

2. Your site is slow or your host emails you about "resource abuse." Malware often runs background scripts — spam mailers, crypto miners, or bots — that eat server resources. If your host suspends you "for abuse" and you didn't do anything, assume infection first.

3. Google flags you in Search Console, or your site redirects to sketchy pages on mobile only. Cloaked malware shows a clean site to admins/desktop but redirects real visitors (especially mobile) to spam or phishing pages. Always check your site from an incognito window on mobile data, not just your own logged-in browser.

If any of these look familiar, don't just delete the obvious stuff and call it fixed — most hacks leave backdoors that let attackers back in within days. Full core file diffing + database scan is the only way to actually be sure it's gone.