What does it look for?

WM Guard scans PHP-related files in uploads, theme, plugin, and MU-plugin directories for deliberately narrow signatures such as obfuscated code execution, nested decoding, direct execution of user input, or known web-shell patterns.

Bounded local scan

The scan runs locally with fixed time and file limits and skips very large files. Results are cached for twelve hours so large sites are not fully rescanned on every page view.

A match is a reason to investigate

The signatures are designed for high confidence but cannot replace a full malware investigation. If a match appears, do not blindly execute or delete the file; compare it with backups, the original source, and, when appropriate, a security specialist.