Website flagged or hacked: what to do now

A Google warning, a strange redirect or an unknown admin account usually means someone is misusing your website. Act today, in this order.

Call whoever manages your website (agency, developer or host). Ask them to keep a copy of the current state for investigation, then clean the site: unknown files, plugins, admin accounts, redirects and scheduled tasks.
From a clean computer, change the passwords of the website admin, hosting, domain registrar and email accounts, and turn on two-step sign-in.
Update the website software, its theme and plugins, and remove what you do not use.
When the site is clean, request a review in Google Search Console (Security issues). The warning usually goes away a few days after a successful review.
If customer personal data may have been exposed, you may have to notify your data protection authority within 72 hours (GDPR, article 33) and tell the people affected.
Write down what you saw, when, and what was done: your insurer or a client may ask.

Fmind Cyber AI observes your website from outside and cannot clean it or confirm a compromise; these steps are general advice.