This guide is still a WIP. If you have anything to add to the stuff that I've completed, don't hesitate to comment on this post to tell me.
Let me first start this guide off by saying this: To my knowledge, it's not always possible to tell if a Pokemon is hacked. It's possible for Pokemon to be hacked to look legitimate in every way, making either impossible or near-impossible to tell if it's legitimate or not.
Now, for the guide.
What location the Pokemon was obtained: If a Pokemon's summary says that it was obtained in a location in which that Pokemon cannot be obtained, it's hacked.
Illegitimate moves: This is one of the easiest things to spot. Go to a Pokemon's page on this website, Bulbapedia, Serebii, etc. and make sure that it can have all of the moves that it does. Finding out if a Pokemon's level-up moves are legitimate is easy enough, but be sure to take into account each generation, as well as TM/HM, event, tutor, transfer-only, and egg moves. If my memory is correct, the summary screen should tell in what generation a Pokemon was obtained, as well as the date and location it was obtained. (Not positive about the date and location part for transferred Pokemon, if someone could confirm or deny this in the comments, that'd be great.) Also keep in mind that Pokemon from Gen 1 could not be transferred past Gen 2 until January 24, 2016, and after that date, can only be transferred from the Virtual Console versions to Gen 7 games. Furthermore, Pokemon from Gen 2 previously could not be transferred past Gen 2 until November 19, 2017, and can only be transferred from the VC versions to Gen 7 games. That means Pokemon with moves previously exclusive to Gen 1 or 2 in Gens 3-6 are hacked and Pokemon with moves previously exclusive to Gen 2 obtained on November 18, 2016 (the day of the release of Sun/Moon, and the only day Gen 2 VC could not transfer to Gen 7) are hacked.
Illegitimate abilities: Checking for illegitimate abilities is very similar to checking for illegitimate moves, but much easier. Go to a Pokemon's page and, if has any ability that is not listed as one of the abilities it can have normally, it's hacked. If a Pokemon has its hidden ability, make sure its method of being obtained was one of these, if possible. If the method of obtaining was event, it would also be smart to check Serebii's event database and make sure that your Pokemon matches up with the Pokemon from whatever event it was from. Keep in mind that some Pokemon have not been released with their hidden ability. Check Bulbapedia's pages on Pokemon with released hidden abilities in Gen 5, Gen 6, and Gen 7.
Illegitimate levels: If a Pokemon is on a level that it cannot be legitimately obtained on, it's hacked. Remember that, sometimes, Pokemon can be obtained on levels before they should evolve into that Pokemon in the wild, through in game trades, and events, so be sure to check every method of obtaining the Pokemon you're hack checking. The second stages of baby Pokemon can be legitimately obtained on level 1 if it must hold an Incense to get the baby Pokemon through breeding.
Ribbons: Many, if not all, event Pokemon, have an event ribbon of some sort. Any Pokemon that are meant to imitate event Pokemon that do not have a ribbon or the correct ribbon are hacked. It's also worth noting that Pokemon with these ribbons cannot be deposited into the GTS, so any event Pokemon that is supposed to have a ribbon on the GTS are hacked
OT: A Pokemon's OT can sometimes be an indicator of whether or not it's hacked. Event Pokemon can sometimes have special OTs, but event Pokemon will also sometimes have the OT of the player that obtained it. If an event Pokemon has a special OT, and a Pokemon is missing it, it's likely hacked. Also, many Twitch Streamers and Youtubers that trade hacked Pokemon have OTs that end in .tv, .yt, or similar things, (for example, ShinyGTS.com is a common one) so, if a Pokemon has one of those OTs, assume that it's hacked.
Shiny locked Pokemon: Any Pokemon on this list from a corresponding generation that is shiny is hacked. The Pokemon on the list at the bottom of this page are shiny locked, which means they cannot be caught shiny.
Event Pokemon: I covered an important part of seeing if event Pokemon are legitimate in the ribbons section, so go read that if you haven't. Other than a lack of a special ribbon, there are some other ways you can tell if an event Pokemon is hacked or not. One of the easiest, but not quite precise ways, to tell is if the Pokemon is from an old event. In this question, it was determined that the asker's Shaymin was from a 2009 event, but it was modified to be shiny. I, personally, would not assume this Shaymin to be legit at all, even if it wasn't shiny. At the time that question was asked, the Shaymin event was already nine years over. It is entirely possible for Pokemon from events this old to be legit, however, it is unlikely. Any reasonable person wouldn't put a Pokemon they knew was from a nine year old event onto Wonder Trade to trade it away for something completely random, and, I, personally, wouldn't trade it away at all, unless I got a very good offer.
Illegitimate Pokeball: Some Pokemon can only be received in special Pokeballs, and some cannot be obtained in special Pokeballs. This guide/list will help you figure out if your Pokemon is in an illegitimate ball.
Illegitimate stats: I'm not quite sure how to explain this. Put your Pokemon's nature, stats, and level into this calculator. If any errors show up when you press the calculate button, it's likely that your Pokemon has illegitimate stats.