Built by security researchers, not just plugin developers.
Guardian Gaze is a product of RedSecLabs, a London-based cybersecurity firm. We build the plugin we wanted while investigating compromised WordPress sites, one that doesn't just match signatures, but actually reasons about what code is doing.
The plugin started as a research tool. The RedSecLabs research team spends a lot of time inside compromised WordPress estates, usually called in after a client's site has been hacked, and traditional security tools have marked it clean.
What we kept seeing was the same pattern. The signature scanners had done their job. The firewalls had done theirs. But sitting inside the install, across the file tree and the database, were backdoors that looked just enough like legitimate plugin code to pass automated review.
We started reasoning about code intent manually, file by file. We built tools to help. Then we realised those tools were the security plugin WordPress needed, one that does not ask "have I seen this exact pattern before?" but "would a reasonable person look at this code and call it legitimate?"
That's the wedge Guardian Gaze fills. It's deliberately narrow. It complements the security stack you already have, rather than trying to replace it.
"Attackers have evolved beyond simple malware signatures. They're writing backdoors that look exactly like legitimate plugin code. You need AI that can reason about what code is actually doing."
Four principles that shape every release.
You stay in control.
Guardian Gaze never modifies or deletes anything without your sign-off. Every finding is presented for review. No silent quarantine. No automatic deletion. Ever.
Privacy by design.
No passwords leave your site. Only minimal security metadata is sent to our API. External services are limited and documented in our privacy disclosure. Source code is public on WordPress.org.
Findings explained in English.
A rule name on its own does not help anyone act. Every Guardian Gaze finding includes a reasoning summary in plain English, so you can decide what to do without re-reading the file yourself.
Honest about scope.
Guardian Gaze is the code-level layer. It is not a perimeter firewall and it is not trying to be one. We tell you exactly where it fits in your stack, and when something else is the better tool.
FOUNDERS & TEAM
The Humans Behind the Shield
A tight-knit team of cybersecurity experts united by one goal; making WordPress protection accessible to everyone.
Rafay Baloch
Founder / CEO
CEO of RedSecLabs, a CREST & PCI QSA-certified offensive security firm. White-hat hacker, published author, and international speaker with deep expertise in penetration testing and security engineering.
Atif Shaukat
Co-Founder
Regional Director of Cyber Security (EEMEA) at Mastercard. Accomplished entrepreneur who has led technology products to multimillion-dollar deals across high-growth markets with a value-driven approach.
Raabia Riaz
Data Analyst
Detail-oriented Data Analyst skilled in Python, SQL, ML, and NLP. Specialises in predictive analytics, machine learning models, and translating complex datasets into actionable business insights.
Muhammad Samaak
Technical Lead & Security Expert
Penetration Tester & AppSec Engineer at RedSecLabs. Specialises in web application, mobile, API, and cloud security testing, leveraging deep expertise in vulnerability management and the OWASP framework.
Huzoor Bux
Senior Software Engineer
Senior Software Engineer focused on building secure, scalable, and high-performance systems. Experienced in backend architecture, application security, and developing reliable solutions for modern web platforms.
A small team of WordPress malware analysts.
We are a research-led team; most of us spend more time reading malware than writing plugin features. That informs everything Guardian Gaze does.
Rafay Baloch
Security researcher and founder. Long history of publishing on browser security, web application vulnerabilities, and emerging malware techniques. Drives research direction at RedSecLabs.
Threat Research team
Investigates real-world WordPress compromises, reverse-engineers backdoor families, and turns what we find into detection logic that ships in Guardian Gaze. Adds new patterns to our threat library as they appear in the wild.
Product & Engineering team
Builds the plugin itself, scanner core, reasoning layer, admin UI, alerting, integrations. Focused on making security tooling that does not slow your site down or scare your customers.
Want to talk?
Whether you are a customer, a journalist, a researcher with a finding, or someone considering Guardian Gaze for your stack, we would love to hear from you.
Try the plugin we built for our own work.
Install Guardian Gaze on one WordPress site for free. Run a scan. See the kind of reasoning we wished we had when this all started.