A lockout or a blocked request is usually a bot, not proof someone is inside. Start with what you can see:

1. Can you still sign in to WordPress with your own password and two-factor?
2. Does the homepage look like you left it, or did text, links, or redirects appear?
3. Open Hub Activity. A lockout means failed passwords were blocked. A file hit means the scanner saw a change.

If you just updated a plugin, a file change can be normal. If you did not change anything, and the site looks wrong or new admin users appeared, treat it as already hacked. A subscription does not rewind that. Cleanup is $199 once, or included once a year on Shield Care. A person replies within 1 business day.

What to do next if the site still looks like yours: leave lockouts and the scanner on. Two-factor is optional until you enroll. Update plugins in WordPress. You never change DNS.

Already hacked or Turn on two-factor.