Guardian Gaze layers four detection methods: signature matching, file-integrity verification, heuristic analysis, and (on Pro) LLM-assisted reasoning, across every PHP file, theme, plugin, mu-plugin and database table on your site. Scans run server-side via WP-Cron, never blocking page loads.
Most WordPress scanners rely on a single technique, signature matching. That works for known threats but falls apart against polymorphic malware, encoded payloads and threats that live in the database rather than on disk. Guardian Gaze runs four detection methods in parallel and cross-references findings, so a single finding can be verified against multiple signals before it surfaces in your dashboard.
Compares file hashes and code fragments against a maintained library of known malware patterns, web shells, dropper scripts, SEO-spam injectors, redirect malware, common backdoor patterns.
Hashes every WordPress core file and compares against the official WordPress.org checksum manifest. Any byte-level deviation is flagged for review, even if the modification is benign.
Detects suspicious code patterns common in malware: eval() on encoded input, base64_decode chains, gzinflate wrappers, dynamic include calls, and obfuscation layers, patterns that legitimate code rarely uses but malware leans on.
For files that pass the first three layers but still look suspicious, our LLM-assisted scanner reads the code and reasons about intent, catching polymorphic, context-dependent and multi-stage threats that signature scanners miss.
Scans run asynchronously via WordPress cron, the heavy lifting is offloaded to our API. There's no signature database loaded on every request, no PHP worker held hostage during a scan, no impact on front-end page-load time. Benchmarked under 50ms overhead on shared hosting.
The scan kicks off on schedule (daily on Free, hourly on Pro) or on demand. The first thing it does is queue a job, control returns to WordPress immediately so the site stays responsive.
The worker walks WordPress core, plugins (active and inactive), themes, mu-plugins, drop-ins, and uploads. Each file is hashed, signature-checked and heuristically scored.
Files that score high on heuristics but don't match known signatures get sent to the LLM scanner for behavioural reasoning. Is this code's actual intent malicious?
File findings are cross-referenced against database findings (e.g. a suspicious file that's loaded by a wp_options row). Each issue gets a severity badge: Critical / High / Medium / Low / Info.
Results surface in the Guardian Gaze dashboard with plain-English explanations. Nothing is auto-deleted, review-before-action is the default. You quarantine or restore from the UI.
The A to D risk grade for your site is recomputed from the latest scan, Malware Status is one of four dimensions feeding the score, alongside Integrity, Login Security and AI-Based Security.
This isn't a hypothetical list, these are the specific malware categories Guardian Gaze surfaces on real customer sites, drawn from incident-response work and threat-intelligence feeds.
Malware scanning is part of every Guardian Gaze plan. The free tier is permanent, there's no trial expiration. Paid tiers unlock the LLM scanner, real-time monitoring, hourly cadence and database scans.
| Capability | Free | Pro | Agency |
|---|---|---|---|
| Signature matching | ✓ | ✓ | ✓ |
| File-integrity (core checksums) | ✓ | ✓ | ✓ |
| Heuristic analysis | ✓ | ✓ | ✓ |
| LLM-assisted reasoning | ✗ | ✓ | ✓ |
| Scheduled scan cadence | Daily | Hourly | Hourly |
| On-demand scans | 3 / day | Unlimited | Unlimited |
| Real-time file change monitoring | ✗ | ✓ | ✓ |
| Database scanning | ✗ | ✓ | ✓ |
| Bulk licence keys in one dashboard | ✗ | ✗ | ✓ |
Most WordPress security plugins (Wordfence, Solid Security, Jetpack Security) run their scanner inside the WordPress PHP process, the same process malware lives in. Once an attacker has shell access, they can disable or tamper with an in-process scanner. Guardian Gaze runs server-side, outside the PHP request lifecycle, so the scanner remains intact even after a compromise. See the full architecture breakdown on the Wordfence comparison.
The free plugin installs from the WordPress directory, runs an initial assessment in 2 to 5 minutes, and shows you an A to D risk grade for your site. No card required.