Signature scanners ask "does this file match a known bad pattern?". Guardian Gaze's LLM scanner asks "does this code behave like it has unauthorised intent?", analysing execution flow, behavioural context and obfuscation patterns to catch the polymorphic, multi-stage and context-dependent threats that signature-only scanners miss by design.
The shift to polymorphic and obfuscated malware over the past five years means signature scanning only catches the threats it has already seen and indexed. Attackers regenerate their payloads on each infection precisely so the resulting file hashes don't match anything in any database. Every dedicated signature scanner, Wordfence, Sucuri, Jetpack, runs into the same wall.
The LLM scanner doesn't care what the code looks like; it cares what the code does. A backdoor that decodes a base64-encoded string and executes it is still a backdoor, even if every byte of it is unique to this infection.
Code that rewrites its own structure on every infection, variable names randomised, control flow permuted, string constants base64'd differently each time. No two copies have the same hash, so signature scanners are blind. The LLM reads intent and catches them.
Nested encoding, base64_decode(rot13(hex2bin(...))), stacked multiple layers deep. Signature engines that don't unwrap recursively miss the payload. The LLM recognises the pattern of "code that exists only to hide other code" and flags it.
Payloads stored in wp_options, wp_postsor transients, invisible to file scanners. The LLM analyses suspicious DB content alongside file scans. See the database scanning page for detail.
Code that only activates when a specific cookie, user-agent or referrer is present, completely silent during ordinary scans. The LLM reads the conditional logic and flags suspicious gates.
Legitimate-looking plugin code with a malicious payload wedged into an update routine or activation hook. The LLM compares observed code against the plugin's expected behaviour for its version and flags divergence, even if the host plugin is real.
A stage-one file that looks innocent and downloads the real payload from an external server only when triggered. The LLM recognises the download-and-execute pattern even when each individual function looks benign in isolation.
The LLM doesn't just say "this is suspicious"; it categorises the finding so you know exactly what you're looking at when deciding how to respond.
The LLM scanner is expensive per-file relative to signature scanning, so we run it server-side, not inside WordPress. Files that pass the cheap layers (signatures, integrity, heuristics) but still score high on heuristics get escalated to the LLM. The LLM analyses them in our infrastructure and returns findings to your dashboard.
Because the analysis happens off your server, there's zero CPU or memory impact on your site even during a full deep scan. The plugin runs lightweight; it queues findings, displays them in the dashboard, and lets you act. The heavy lifting never touches your PHP workers.
LLM analysis is fundamentally slower per file than a hash lookup. That's why we run it server-side and only on files that the cheap layers can't conclusively clear. A full deep scan can take 2 to 10 minutes on a large site; subsequent incremental scans are much faster.
Heavily-obfuscated legitimate code (some commercial plugins, some optimisation tools) can trigger the LLM's "this looks like it's hiding something" heuristic. That's why review-before-action is the default; every finding surfaces in the dashboard for human confirmation before anything is quarantined.
The LLM infrastructure has real per-scan cost, so it sits on the Pro tier ($149.99/yr) and above. The free tier still gives you signature scanning, integrity monitoring and heuristic analysis, about 70% of the malware coverage. The LLM is what adds the polymorphic and obfuscated categories on top.
| Capability | Free | Pro | Agency |
|---|---|---|---|
| Signature + heuristic scanning | ✓ | ✓ | ✓ |
| LLM-assisted reasoning on suspicious files | ✗ | ✓ | ✓ |
| Polymorphic backdoor detection | ✗ | ✓ | ✓ |
| Multi-layer obfuscation unwrapping | ✗ | ✓ | ✓ |
| Context-dependent payload analysis | ✗ | ✓ | ✓ |
| Database-resident malware analysis | ✗ | ✓ | ✓ |
| Plain-English explanation per finding | ✗ | ✓ | ✓ |
Free tier installs immediately. Upgrade to Pro to unlock the LLM layer on the same site, same dashboard.