Practical answers from the team that builds and supports Guardian Gaze.
About two minutes from "Add New Plugin" to your first scan running. Search for "Guardian Gaze" in the WordPress plugin directory, click Install Now, then Activate. The initial scan kicks off automatically and finishes in 2 to 5 minutes depending on site size.
The first scan after activation builds a baseline and runs the core detection layers:
You get an A to D risk grade for your site within minutes.
No. Guardian Gaze runs entirely as a WordPress plugin, no SSH access, no nginx/Apache config, no .htaccess changes, no DNS modification required. The heavy scanning work happens server-side via our API, but the plugin handles the connection transparently.
WordPress 5.8+, PHP 7.4+ (PHP 8.x recommended for performance), and MySQL 5.7+ or MariaDB 10.3+. Works on all major hosts including shared hosting, benchmarked under 50ms overhead on shared. Compatible with WP Multisite (per-subsite configuration).
No measurable front-end impact. The plugin itself is lightweight; the actual scanning is offloaded to our infrastructure rather than running inside the PHP request cycle. Scans are asynchronous via WordPress cron and don't block page loads. Benchmark: under 50ms overhead on shared hosting, roughly 5% of Jetpack's plugin footprint.
Guardian Gaze runs four detection layers in parallel:
See the malware scanning page for the full breakdown.
It reads the code in a file and reasons about its intent. Does this code behave like a backdoor? Does it have features only malware needs (encoded payloads, hidden conditional execution, remote-code execution patterns)? It's particularly strong against polymorphic backdoors (code that changes structure with each infection), multi-layer obfuscation, and context-dependent payloads that only activate on specific triggers. See the LLM detection page.
You're right that most scanners miss it; that's exactly why we have a dedicated database scanner (Pro and above). We read wp_options, wp_posts,wp_postmeta, wp_users andwp_usermeta directly, deserialise PHP-serialised data, and look for encoded payloads, hidden admin users, fake transients, SEO spam, and persistence mechanisms. About half of modern WordPress malware lives in the database; missing it is the reason "cleaned" sites get re-infected. See database scanning.
On the Pro tier and above, yes, a web application firewall that filters requests at the HTTP layer before they reach WordPress, plus virtual patching that protects against known plugin vulnerabilities in the window between disclosure and the official patch.
A single grade summarising your site's security posture, calibrated across four dimensions: Malware Status, System Integrity, Login Security, and AI-Based Security. Scoring:
The grade recalculates after every scan.
Review-before-action is the default; we never auto-delete or auto-modify files without your explicit confirmation. From the dashboard you can one-click quarantine a flagged file (it moves to a secure location, removed from WP's load path). On Pro and above, one-click cleanup tools handle most common malware categories. On Agency, our team can handle full incident response as an add-on.
Permanent free tier, no expiration. Free includes signature + heuristic + integrity scanning, daily scheduled scans, on-demand scans (3/day), login security (brute-force + 2FA + CAPTCHA), IP block lists and whitelists, all fifteen hardening toggles, and email alerts.
The Pro tier adds the LLM scanner, full database scanning, real-time file-change monitoring, hourly scheduled scans (vs daily), unlimited on-demand scans, the WAF and virtual patching, country-level IP blocking, the IP reputation feed, plain-English AI explanations on every finding, Slack/webhook notifications, and the multi-site dashboard (up to 5 sites).
Everything in Pro, plus coverage for up to 25 sites (vs 5), a multi-site central dashboard, client-facing white-label reports, bulk scan scheduling, multi-site configuration sync, multi-site IP-list sync, multi-site digest emails, priority support with a 4-hour SLA, and escalation pathway to the RedSecLabs research team for critical findings. Above 25 sites we quote custom pricing, talk to us.
Annual only at the moment. The $149.99/yr and $399/yr prices are list. Volume discounts apply on the Agency tier for fleets above 10 sites, see the agencies page.
Yes. Cancel from your account at any time; you keep Pro access until the end of your billing period, then drop to the free tier. No data loss; your scan history, findings, audit trail and dashboard all remain.
Wordfence Premium is $119/yr, cheaper, but signature-only with no LLM scanner and no database scanner. MalCare is $149/yr (same as us) but scans in their cloud rather than server-side. Sucuri is $199.99/yr and includes a cloud WAF + CDN. Full comparisons: Wordfence, Sucuri, MalCare, Solid Security, Jetpack Security.
Technically yes, we don't conflict with Wordfence, Sucuri, MalCare or Solid Security at a code level. But running two security scanners means duplicated work and duplicated alerts. In practice, pick one. Most customers replace their existing scanner; some keep Solid Security alongside us purely for its hardening checklist UX.
Yes, fully compatible with WP Rocket, W3 Total Cache, LiteSpeed Cache, and all major caching solutions. Our scans don't interact with the page cache.
Yes. On a multisite network, each subsite has its own configuration and dashboard. The Network Admin can apply hardening profiles across all subsites simultaneously.
The plugin uses your license key as the API key. All traffic between the plugin and our infrastructure is HTTPS. The plugin sends scan metadata (file paths, hashes, suspicious-snippet fragments), not the full content of every file on your site, and never any user data.
The plugin itself is lightweight; it queues scan jobs, reports status, renders the admin UI. The actual signature matching, heuristic analysis, and LLM reasoning happen on our infrastructure. This is the key architectural difference from in-process plugins like Wordfence; even if an attacker compromises your WordPress, they can't disable our scanner because it doesn't run in their reach.
On WordPress.com Business and higher (the plans that allow third-party plugins), yes. On lower WordPress.com tiers that don't allow plugins, no, that's a WP.com platform limitation, not ours.
Security-relevant metadata only: file paths, file hashes, snippets of suspicious code (when they trigger a heuristic), the WordPress and plugin/theme versions, the site URL, the admin email (for license linkage), and IP addresses involved in security events.
What we never send: customer PII, post content, passwords, session tokens, database contents (unless flagged as suspicious, in which case the specific row is sent for analysis), or anything else you wouldn't expect a security plugin to handle.
Yes. Unlike cloud-side scanners (e.g. MalCare) that send copies of your site to their cloud and become Article 28 processors of your visitor data, Guardian Gaze processes your site contents locally on your server. We're not a processor of your visitor data; we're a processor of your site's security metadata only. That's a meaningfully simpler legal relationship.
RedSecLabs is a London-based company; our infrastructure is hosted in the EU/UK. For Agency customers with specific data-residency requirements we can document the deployment region in a DPA.
You do. Findings, audit trail, scan history, configuration, all yours. Export to CSV from the dashboard anytime. If you cancel, you can request full deletion via the contact form.
It's a fair question. Our infrastructure is hardened, monitored and audited. We disclose vulnerabilities publicly under our responsible disclosure policy and notify customers within hours of any confirmed material incident. Architecturally, the plugin's worst case is that the scanner reports false negatives; it cannot escalate into a compromise of your site, because the plugin doesn't have arbitrary code-execution privileges from our side.
For most standard WordPress compromises (backdoors, SEO spam, redirect malware, database persistence), yes. Install Guardian Gaze, run a deep scan, review findings, quarantine the infected files, apply the recommended hardening. On Agency plans we can do the cleanup for you within hours. For complex multi-stage breaches involving the host's other services, Sucuri's human incident-response team has a longer track record; we'll be honest if your situation is one of those edge cases.
Use the bug report form on the site. For security-sensitive bugs, follow our disclosure policy.
Free tier: best-effort email (typically 1 to 3 business days). Pro: priority email (one business day). Agency: 4-hour SLA, plus a dedicated Slack channel for ongoing incidents.
Send it via the contact form. For feature-specific questions, every feature page has its own deep dive.
Our support team has answered 10,000+ tickets across every kind of WordPress site. If your question isn't here, it almost certainly isn't unusual.