Most security scanners hand you a list of suspicious files and a CVSS score and assume you can figure it out from there. Guardian Gaze's AI reports explain, in language a site owner can read, what each flagged piece of code actually does, why it's suspicious, what the impact would be if you ignored it, and the specific remediation step to take.
Every threat the AI surfaces is presented with the same structured fields, designed so you can scan them quickly, prioritise the urgent ones, and act without needing to read PHP.
One-line plain-English description: "Obfuscated PHP backdoor that grants remote code execution when a specific cookie is present."
Critical · High · Medium · Low · Info. Calibrated to threat type, exploitability and reachability; a backdoor in mu-plugins/ is Critical regardless of what it does.
File path, line numbers, the exact code snippet that triggered the finding, the hash of the file, and the version of the host plugin/theme if applicable.
What the code does and why the AI flagged it. Not a generic template, generated from the actual code observed, referencing the specific suspicious patterns it contains.
Step-by-step remediation, "Quarantine the file via Guardian Gaze's UI · run a full deep scan · rotate the WP secret keys · review the audit trail for accesses from this IP."
What an attacker could do with this if exploited, admin takeover · data theft · SEO spam · blacklist by Google · malware distribution to visitors. Risk level Low / Medium / High.
The impact section maps the finding to the concrete consequences your site faces. These aren't hypothetical, every category here is something we've seen happen on real customer sites.
Severity isn't a vague impression; it's a calibrated category. Here's what each badge means in practice and how quickly you should act.
Active malware or live backdoor with admin-equivalent access. Act within hours.
Confirmed malicious code without active reachability, or vulnerable component with public exploit. Act within a day.
Suspicious code requiring review. Likely action: investigate and decide within the week.
Configuration drift or minor hardening miss. Address in next maintenance window.
Notable but not actionable, version updates, file changes correlated with known events.
Obfuscated PHP web shell granting remote code execution via a hidden POST parameter.
Critical · Risk: High · Recommended action within hours.
Path: wp-content/uploads/2024/02/.cache.php
Lines: 1 to 14
Hash: 4f3a2c…b91 (not in baseline)
Created: 2026-04-18 14:22 UTC
The file consists of a base64-encoded blob that is decoded at runtime and passed to eval(). The decoded content checks the POST request for a key named x and, if present, executes the value as PHP. This is a classic single-line web shell, minimal, functional, and highly common in active compromises. The file's location in uploads/(where executable code should never live) is itself a strong indicator.
Full remote code execution, an attacker with this URL can read, modify or delete any file accessible to PHP, including wp-config.php and database credentials. Reachable: yes, from any internet-accessible IP. Authentication required: no.
1. Quarantine the file via the Guardian Gaze dashboard (one click).
2. Run a full deep scan to look for related infections.
3. Rotate WordPress secret keys and database password.
4. Review the audit trail for accesses from this URL in the last 90 days.
5. Block the source IP(s) seen in the access logs.
| Capability | Free | Pro | Agency |
|---|---|---|---|
| Plain-English finding summaries | ✗ | ✓ | ✓ |
| Severity badges (Critical to Info) | Critical only | ✓ All 5 | ✓ All 5 |
| AI explanation per finding | ✗ | ✓ | ✓ |
| Recommended remediation steps | ✗ | ✓ | ✓ |
| Impact & risk analysis | ✗ | ✓ | ✓ |
| Export reports (PDF / CSV) | ✗ | ✓ | ✓ |
| Client-branded reports (white-label) | ✗ | ✗ | ✓ |
Install free, upgrade to Pro, run a deep scan, and you'll have a full AI report for every finding within 10 minutes.