One-click malware removal, fix it without touching the filesystem.
Restore infected core, plugin and theme files from clean WordPress.org copies in one click. Unknown malicious files get a safety check, then safe deletion.
Availability: included from Pro upwards, via the Premium add-on · One-click malware removal
Security score
- FirewallProtected
- Backdoor detectionClean
- Malware scanClean
- Audit logMonitored
- Login securityProtected
- Vulnerability scanClean
The plugin view: findings, severity and next steps inside the WordPress admin
One-Click Malware Removal at a glance
Known file → restore
If the infected file belongs to WordPress core, an installed plugin, or a theme, Guardian Gaze pulls the clean version directly from the official WordPress.org repository, matching the exact version installed, and overwrites the infected copy.
Unknown file → safety-checked delete
If the file isn’t part of any active plugin or theme, a typical webshell or backdoor signature, Guardian Gaze verifies the file isn’t referenced anywhere in active code, shows you a clear warning, and lets you permanently delete it.
One-Click Malware Removal
When a scan flags an infected file, Guardian Gaze tells you exactly what to do next. For WordPress core, plugin, and theme files, it can automatically
Detection without removal is an accurate description of your problem
A scanner that finds malware and stops there has done the hard technical work and left you with the hard practical one. You now know there is a backdoor in a theme file at a path you have never opened, and it is late, and the site is live.
The market has largely settled on selling those two things separately. You buy the scanner, it finds something, and cleanup is a professional service billed per incident: typically between $200 and $500, sometimes more, usually with a turnaround measured in hours you do not have.
Pro includes removal at roughly $8 a month. That comparison is the entire commercial argument for the plan, and it survives being stated plainly: one incident, once, pays for several years of the licence.
Quarantine first, delete second
Removal cleans confirmed malware from files and from database rows, and it does it with quarantine underneath rather than in place of it. A suspect file is isolated so it cannot execute, and it can be restored if the call turns out to be wrong.
That ordering is what makes the button safe to press. Irreversible cleanup on a live site is a genuinely frightening action, and the fear is well founded: the failure mode of an aggressive scanner is deleting a legitimate file that a plugin needs, at which point you have traded a possible compromise for a certain outage.
For database findings, cleanup targets the flagged content rather than dropping whole rows, which matters because a wp_options row may contain one injected script inside a large legitimate settings blob. Deleting the row would take the settings with it.
What a plugin cannot fix from inside WordPress
Some things sit outside what any WordPress plugin can reach, and pretending otherwise is how people end up believing a site is clean when it is not.
A compromised hosting account, a stolen SFTP credential, a vulnerable server configuration, malware living outside the WordPress directory, or a backdoor in a cron job at the system level, none of those are reachable from inside WordPress, whatever the plugin claims. If the route back in is at the host level, cleaning WordPress buys you the interval until they use it again.
When removal cannot complete, you get the finding in full (path, severity, explanation) and quarantine to contain it, rather than a false all-clear. On Agency, critical findings can be escalated to the RedSecLabs research team.
Common questions
Works with
Malware Scanning →
Four detection methods, cross-referenced.
Database Scanning →
Payloads hide in tables, not just files.
File Integrity →
Byte-level change detection on every file.
See it on your own site
The free scan takes under five minutes and tells you the truth.