1. The browser warns you, or the padlock is missing
If the browser shows "Not secure", or visitors get a certificate warning, the connection is not properly encrypted. It is one of the first things customers notice, and many go elsewhere.
2. The site has not been updated in a long time
If you use WordPress or another system with plugins, security updates come out regularly. If updates are waiting, or a plugin is no longer maintained, that is one of the most common ways in for attackers.
3. Customers get emails you did not send
If customers mention strange emails or fake invoices from your domain, the domain probably lacks protection against forged email. This is solved with SPF, DKIM and DMARC.
4. Things happen that you cannot explain
New administrators you did not create, pages or links that have appeared, visitors being redirected to other sites, or a warning from Google that the site may be hacked. Any of these can mean someone is already in.
5. The login is protected by a password alone
If you can log in as an administrator with only a password, one leaked password is all it takes for a full break-in. The same goes if former employees still have access.
Is this a problem for you?
It can be technical to check and fix properly. Let me take a look at it for you.
Reply within 1-2 working days.