Website hacked what to do

First, don't panic: change all your passwords (hosting, website admin panel, database, email and FTP access), put the website into maintenance mode or take it offline if it's harming visitors, and let your hosting provider know. Then restore a clean backup from before the attack and update everything before opening it again.

The typical signs are redirects to strange pages, content you didn't put there, a Google warning saying the site is dangerous or your hosting suspending your account. What confuses people most is believing it's enough to delete what you can see: whoever gets in usually leaves back doors to come back through, which is why the safe thing is to restore a clean copy or reinstall. Also look for how they got in, because if you don't close that door it'll happen again. And if the website held customers' personal data, find out as soon as possible whether you have to notify your data protection authority (in Spain, the AEPD): GDPR sets short deadlines.

The break-in attempts my website received and what I did to shut them out I explain in "Where the attacks came from when I published my website". The lesson that applies to everyone: you need the backup before you need it, and stored somewhere other than the website's server.