Frequently asked questions.

About two minutes from "Add New Plugin" to your first scan running. Search for "Guardian Gaze" in the WordPress plugin directory, click Install Now, then Activate. The initial scan kicks off automatically and finishes in 2 to 5 minutes depending on site size.

No. Guardian Gaze runs entirely as a WordPress plugin, no SSH access, no nginx/Apache config, no .htaccess changes, no DNS modification required. The heavy scanning work happens server-side via our API, but the plugin handles the connection transparently.

No measurable front-end impact. The plugin itself is lightweight; the actual scanning is offloaded to our infrastructure rather than running inside the PHP request cycle. Scans are asynchronous via WordPress cron and don't block page loads. Benchmark: under 50ms overhead on shared hosting, roughly 5% of Jetpack's plugin footprint.

The first scan after activation builds a baseline and runs the core detection layers:

• WordPress core file integrity (hashed against WordPress.org checksums)
• Plugin and theme files (signature + heuristic scanning)
• mu-plugins and drop-ins
• Vulnerable plugins via the Wordfence Intelligence vulnerability feed
• Login hardening status (2FA enabled? brute-force protection on? etc.)
• The fifteen hardening toggles, current state of each

You get an A to D risk grade for your site within minutes.

WordPress 5.3+, PHP 7.0+ (PHP 8.x recommended for performance), and MySQL 5.7+ or MariaDB 10.3+. Works on all major hosts including shared hosting, benchmarked under 50ms overhead on shared. Compatible with WP Multisite (per-subsite configuration).

Guardian Gaze runs four detection layers in parallel:

• Signature matching, fast, catches known malware patterns with near-zero false positives.
• File integrity, flags any file that diverges from the WordPress.org checksum or your installed-version baseline.
• Heuristic analysis, looks for suspicious patterns (eval on encoded input, base64_decode chains, etc.).
• LLM reasoning (Pro), reads code and reasons about intent for files the first three layers can't conclusively clear.

See the malware scanning page for the full breakdown.

Most established scanners do check it, but largely by signature; that is why we run a dedicated database scanner (Pro and above). We read wp_options, wp_posts, wp_postmeta, wp_users and wp_usermeta directly, deserialise PHP-serialised data, and look for encoded payloads, hidden admin users, fake transients, SEO spam, and persistence mechanisms. About half of modern WordPress malware lives in the database; missing it is the reason "cleaned" sites get re-infected. See database scanning.

A single grade summarising your site's security posture, calibrated across four dimensions: Malware Status, System Integrity, Login Security, and AI-Based Security. Scoring:

• A (8.0 to 10.0): Excellent, no active threats, hardening applied.
• B (6.0 to 7.9): Good, minor issues, usually missing hardening.
• C (4.0 to 5.9): Needs attention, vulnerabilities or suspicious files.
• D (0.0 to 3.9): Critical, active malware or severe vulnerabilities.

The grade recalculates after every scan.

It reads the code in a file and reasons about its intent. Does this code behave like a backdoor? Does it have features only malware needs (encoded payloads, hidden conditional execution, remote-code execution patterns)? It's particularly strong against polymorphic backdoors (code that changes structure with each infection), multi-layer obfuscation, and context-dependent payloads that only activate on specific triggers. See the LLM detection page.

On the Pro tier and above, yes, a web application firewall that filters requests at the HTTP layer before they reach WordPress, plus virtual patching that protects against known plugin vulnerabilities in the window between disclosure and the official patch.

Review-before-action is the default; we never auto-delete or auto-modify files without your explicit confirmation. From the dashboard you can one-click quarantine a flagged file (it moves to a secure location, removed from WP's load path). On Pro and above, one-click cleanup tools handle most common malware categories. On Agency, our team can handle full incident response as an add-on.

Permanent free tier, no expiration. Free includes signature + heuristic + integrity scanning, daily scheduled scans, on-demand scans (3/day), login security (brute-force + 2FA + CAPTCHA), IP block lists and whitelists, all fifteen hardening toggles, and email alerts.

Everything in Pro, plus security reporting. Business is $249 per site, per year.

Yes. Cancel from your account at any time; you keep Pro access until the end of your billing period, then drop to the free tier. No data loss; your scan history, findings, audit trail and dashboard all remain.

The Pro tier adds the LLM scanner, plain-English AI explanations, the Security Intelligence API, hourly scheduled scans (vs daily), unlimited on-demand scans, the WAF and virtual patching, country-level IP blocking, the IP reputation feed, plain-English AI explanations on every finding, Slack/webhook notifications, and the multi-site dashboard (up to 5 sites).

Yes, on Basic: $4.99 per site, per month. Pro is $99/yr per site and Business is $249/yr per site, both billed annually. See the pricing page.

Wordfence Premium is $149/yr, strong on signatures and its own vulnerability feed, but detection is pattern-based rather than reasoning about intent. MalCare Protect is $99/yr, the same as Pro, but scans in their cloud rather than server-side. Sucuri Basic is $199.99/yr and includes a cloud WAF + CDN. Full comparisons: Wordfence, Sucuri, MalCare, Solid Security, Jetpack Security.

Technically yes, we don't conflict with Wordfence, Sucuri, MalCare or Solid Security at a code level. But running two security scanners means duplicated work and duplicated alerts. In practice, pick one. Most customers replace their existing scanner; some keep Solid Security alongside us purely for its hardening checklist UX.

Yes. On a multisite network, each subsite has its own configuration and dashboard. The Network Admin can apply hardening profiles across all subsites simultaneously.

The plugin itself is lightweight; it queues scan jobs, reports status, renders the admin UI. The actual signature matching, heuristic analysis, and LLM reasoning happen on our infrastructure. This is the key architectural difference from in-process plugins like Wordfence; even if an attacker compromises your WordPress, they can't disable our scanner because it doesn't run in their reach.

Yes, fully compatible with WP Rocket, W3 Total Cache, LiteSpeed Cache, and all major caching solutions. Our scans don't interact with the page cache.

The plugin uses your licence key as the API key. All traffic between the plugin and our infrastructure is HTTPS. The plugin sends scan metadata (file paths, hashes, suspicious-snippet fragments), not the full content of every file on your site, and never any user data.

On WordPress.com Business and higher (the plans that allow third-party plugins), yes. On lower WordPress.com tiers that don't allow plugins, no, that's a WP.com platform limitation, not ours.

Security-relevant metadata only: file paths, file hashes, snippets of suspicious code (when they trigger a heuristic), the WordPress and plugin/theme versions, the site URL, the admin email (for license linkage), and IP addresses involved in security events.

What we never send: customer PII, post content, passwords, session tokens, database contents (unless flagged as suspicious, in which case the specific row is sent for analysis), or anything else you wouldn't expect a security plugin to handle.

RedSecLabs is a London-based company; our infrastructure is hosted in the EU/UK. For Agency customers with specific data-residency requirements we can document the deployment region in a DPA.

It's a fair question. Our infrastructure is hardened, monitored and audited. We disclose vulnerabilities publicly under our responsible disclosure policy and notify customers within hours of any confirmed material incident. Architecturally, the plugin's worst case is that the scanner reports false negatives; it cannot escalate into a compromise of your site, because the plugin doesn't have arbitrary code-execution privileges from our side.

Yes. Unlike cloud-side scanners (e.g. MalCare) that send copies of your site to their cloud and become Article 28 processors of your visitor data, Guardian Gaze processes your site contents locally on your server. We're not a processor of your visitor data; we're a processor of your site's security metadata only. That's a meaningfully simpler legal relationship.

You do. Findings, audit trail, scan history, configuration, all yours. Export to CSV from the dashboard anytime. If you cancel, you can request full deletion via the contact form.

For most standard WordPress compromises (backdoors, SEO spam, redirect malware, database persistence), yes. Install Guardian Gaze, run a deep scan, review findings, quarantine the infected files, apply the recommended hardening. On Agency plans we can do the cleanup for you within hours. For complex multi-stage breaches involving the host's other services, Sucuri's human incident-response team has a longer track record; we'll be honest if your situation is one of those edge cases.

Free tier: best-effort email (typically 1 to 3 business days). Pro: priority email (one business day). Agency: 4-hour SLA, plus a dedicated Slack channel for ongoing incidents.

Use the bug report form on the site. For security-sensitive bugs, follow our disclosure policy.

Send it via the contact form. For feature-specific questions, every feature page has its own deep dive.