Not every security alert requires a manual cleanup — but some infection patterns are clear signals that automated protection alone won't be enough. This article helps you identify those situations so you know when to escalate to a Monarx WordPress Site Cleanup request.
🔍 Signs Your Site Needs a Cleanup
The following are the most common indicators that a WordPress site has an active infection that warrants a manual cleanup by our Threat Research team.
👻 Rogue administrator accounts keep appearing
If new WordPress admin users are being added to the site without any legitimate action by the account owner, this is a strong indicator of a persistent backdoor. Malware often creates these accounts to maintain access even after surface-level cleanups.
🐛 Spam or malicious posts are being created automatically
If the site is generating posts, pages, or comments with spammy or malicious content — especially in bulk or at regular intervals — this suggests a malware component is actively writing to the WordPress database.
↪️ The site is redirecting visitors to a third-party website
Malicious redirects are one of the most disruptive infection symptoms. If visitors are being sent to external sites (often phishing pages, adult content, or scam pages), there is likely malware embedded in the theme files, a plugin, or thewp-config.phpfile.
🙅 Malicious links or content keep getting injected into pages
Repeated reappearance of spam links, hidden text, or injected iframes — especially after you've manually removed them — indicates that malware is still present and actively re-injecting the content.
🆕 Plugins are being installed without authorization
If new plugins appear on the site without anyone having installed them, this typically means an attacker has established a persistent foothold and is using it to deploy additional tools or backdoors.
🦠 Malicious files keep getting recreated after removal
If you or your team have deleted suspicious files, only to find them reappear shortly after, this is a classic sign of a dropper or persistence mechanism. The malware is regenerating the files from another location on the server — a full cleanup is needed to find and eliminate the source.
❓ Why These Symptoms Require a Manual Cleanup
All of the patterns above share one thing in common: they keep coming back. This is because surface-level removal — deleting a file, removing a user, deactivating a plugin — doesn't address the root cause. Somewhere on the server there is a backdoor, a modified core file, or a database entry that is driving the reinfection.
A Monarx Site Cleanup involves a manual, in-depth review of the site's files, plugins, themes, users, and database by one of our engineers — not just an automated scan. This is what makes it effective against persistent infections.
✋ Before You Submit
Before submitting your request, make sure to:
Review the Technical Requirements for WordPress Site Cleanup to confirm your site meets all the conditions needed for our tools to operate.
Include as much detail as possible in the Notes field when submitting — describe the specific symptoms you are seeing, how long they've been occurring, and any steps already taken. The more context our engineers have, the faster the issue can be resolved.
When you're ready, follow the steps in How to Submit a WordPress Site Cleanup to open your request.