Title: Aystat Detect Hidden Author: stonemanhero Published: November 12, 2026 Last modified: November 13, 2026 --- Search plugins ![](https://ps.w.org/aystat-detect-hidden/assets/banner-772x250.png?rev=3797890) ![](https://ps.w.org/aystat-detect-hidden/assets/icon-256x256.png?rev=3797890) # Aystat Detect Hidden By [stonemanhero](https://profiles.wordpress.org/stonemanhero/) [Download](https://downloads.wordpress.org/plugin/aystat-detect-hidden.1.0.5.zip) * [Details](https://wordpress.org/plugins/aystat-detect-hidden/#description) * [Reviews](https://wordpress.org/plugins/aystat-detect-hidden/#reviews) * [Installation](https://wordpress.org/plugins/aystat-detect-hidden/#installation) * [Development](https://wordpress.org/plugins/aystat-detect-hidden/#developers) [Support](https://wordpress.org/support/plugin/aystat-detect-hidden/) ## Description **Aystat Detect Hidden** is an advanced security auditing and threat remediation plugin designed to expose stealth malware, backdoor administrators, concealed posts, hidden doorway pages, and clandestine plugins. ### The Problem: Hook-Based Cloaking Modern WordPress malware rarely modifies core files directly. Instead, sophisticated attackers and backdoors insert malicious users or content into your database and hook into WordPress filter APIs to keep them invisible: * **Hidden Users:** Malware adds a rogue administrator account to the `wp_users` database table, then registers a hook on `pre_user_query` to filter its own ID out of all standard WordPress queries. To the site owner browsing `/wp-admin/users.php`, the user list appears normal. Malware often also filters `views_users` to tamper with displayed user counter tallies.*** Concealed Posts & Doorway Pages:** Attackers insert SEO spam, phishing forms, or doorway pages into `wp_posts`, then manipulate `pre_get_posts` or `posts_where` so the posts never appear in the WordPress Admin post list. * **Concealed Plugins:** Rogue plugins or backdoors hook into the `all_plugins` filter to hide themselves from the `/wp-admin/plugins.php` interface while continuing to execute on every HTTP request. ### The Solution: Differential Auditing & Hook Inspection Aystat Detect Hidden bypasses hooked filters through deep differential comparison and multi-layered defense-in-depth: 1. **User Differential Audit:** Fetches visible users via standard `get_users()` queries and compares them against raw database rows queried directly from `{$wpdb->users}` and `{$wpdb->usermeta}`. Any user record present in the raw database but excluded from `get_users()` is immediately flagged. 2. **Post & Page Differential Audit:** Executes `WP_Query` with active filters and compares returned IDs against raw database records from `{$wpdb->posts}`. Any post or page omitted from the API query is flagged. 3. **Plugin & Component Audit:** Physically inspects the plugins directory via `DirectoryIterator` (supporting subdirectories, single-file plugins, and unmanaged standalone PHP scripts) and compares physical files against filtered `all_plugins` hook output. 4. **MU-Plugin & Core Drop-in Inspection:** Enumerates all active Must-Use plugins and core architectural drop- ins in the content directory, highlighting high-privilege drop-ins (`db.php`, `object- cache.php`) with elevated security advisories. 5. **Enhanced Hook & Query Inspector:** Leverages PHP Reflection to analyze callbacks on sensitive filters (`query`, `pre_user_query`,` all_plugins`, `posts_where`), revealing exact file paths, declaration line numbers, and anonymous closures. ### Advanced Edition Upgrades Need 1-click threat remediation and autonomous background monitoring? Aystat Detect Hidden Advanced adds: * **1-Click Safe Remediation:** Instantly delete rogue users( with active-admin protection), trash spam posts, and delete unauthorized backdoor files with strict path traversal safeguards. * **False-Positive Whitelisting:** Ignore approved exceptions (custom tools or intentional drop-ins) with a single click, keeping your audit reports clean. * **Autonomous 24/7 Background Scans:** Scheduled WP-Cron runner with configurable scan frequencies. * **Smart State-Diff Email Alerts:** Zero email fatigue — alerts dispatched only when new threats appear.*** Priority Security Support:** Direct developer assistance and priority updates. ## Screenshots [⌊Clean state – security audit dashboard ready to scan.⌉⌊Clean state – security audit dashboard ready to scan.⌉[ Clean state – security audit dashboard ready to scan. [⌊Threat detection results – differential scan exposing hidden components, cloaked users, and hook interceptors.⌉⌊Threat detection results – differential scan exposing hidden components, cloaked users, and hook interceptors.⌉[ Threat detection results – differential scan exposing hidden components, cloaked users, and hook interceptors. ## Installation 1. Upload the `aystat-detect-hidden` folder to the `/wp-content/plugins/` directory, or install directly through the WordPress plugin installer. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. 3. Navigate to **Tools > Detect Hidden** in your WordPress admin menu. 4. Click **Run Security Audit** to execute a full differential analysis. ## FAQ ### Does this plugin affect frontend site speed? No. Audits execute only when an administrator triggers a scan in the admin dashboard. Zero queries or hooks are added to front-end visitor traffic. ### What makes this scanner different from other security plugins? Standard security plugins ask WordPress APIs for lists of users and plugins. If stealth malware has hooked `pre_user_query` or `all_plugins`, standard plugins are blinded by the same hooks. Aystat Detect Hidden queries the database tables and filesystem directly to uncover hidden discrepancies. ### What is the difference between Free and Advanced? The Free version on WordPress.org provides 100% complete differential auditing across users, posts, plugins, drop-ins, and hook inspection. The separate Advanced edition adds 1-click automated threat deletion (users, posts, plugin files), false-positive whitelisting, and 24/7 background WP-Cron scans with smart email alerts. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Aystat Detect Hidden” is open source software. The following people have contributed to this plugin. Contributors * [ stonemanhero ](https://profiles.wordpress.org/stonemanhero/) [Translate “Aystat Detect Hidden” into your language.](https://translate.wordpress.org/projects/wp-plugins/aystat-detect-hidden) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/aystat-detect-hidden/), check out the [SVN repository](https://plugins.svn.wordpress.org/aystat-detect-hidden/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/aystat-detect-hidden/) by [RSS](https://plugins.trac.wordpress.org/log/aystat-detect-hidden/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.5 * Moved Hook & Query Interception Inspector to a dedicated dashboard tab located between Plugins and Advanced Edition. * Hook and query driver inspections are now strictly informational diagnostics and no longer count toward active threats or auditing status. * Removed severity rankings and security risk warnings from Hook Inspector to display a clean, transparent inventory of all registered callbacks. * Added dedicated Hook Inspector empty state and live tab badge counter. * Updated User Guide, contextual Help tabs, and documentation to reflect informational hook diagnostics. #### 1.0.4 * Added Enhanced Hook & Query Interception Inspector using PHP Reflection: extracts exact file paths, line numbers, closure detection, and provenance classification. * Added actionable Threats Found card navigation with automatic tab switching and smooth scrolling to flagged items. * Added False-Positive Whitelist (Ignore/Unignore) feature to approve legitimate exceptions. * Added Clear Scan Snapshot action to reset cached scan states safely. * Updated file and directory path resolution to use core WordPress path functions. * Removed all locked/premium-gated code to ensure 100% free, unrestricted functionality in the WordPress.org edition. #### 1.0.3 * Added defense-in-depth low-level SQL query filter isolation to defeat in-memory query rewrites. * Added critical alert detection for active hooks on the WordPress `query` filter. * Added unmanaged standalone PHP script and headerless plugin directory detection. * Added elevated security warning badge and advisories for `db.php` and `object- cache.php` drop-ins. * Added runtime database driver class integrity checks. #### 1.0.2 * Added perceptible live scanning states and execution time reporting. * Added persistent audit state on page reload. * Scalability optimizations for databases with 30,000+ users and high post counts. #### 1.0.1 * Enhanced button flex layout and Dashicons alignment to prevent line-wrapping. #### 1.0.0 * Initial public release with differential user, post, and plugin auditing. ## Meta * Version **1.0.5** * Last updated **24 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [audit](https://wordpress.org/plugins/tags/audit/)[backdoor](https://wordpress.org/plugins/tags/backdoor/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/aystat-detect-hidden/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/aystat-detect-hidden/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/aystat-detect-hidden/reviews/) ## Contributors * [ stonemanhero ](https://profiles.wordpress.org/stonemanhero/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/aystat-detect-hidden/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://aystat.com)