{"id":397629,"date":"2026-11-12T09:12:52","date_gmt":"2026-11-12T09:12:52","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/aystat-detect-hidden\/"},"modified":"2026-11-13T12:33:49","modified_gmt":"2026-11-13T12:33:49","slug":"aystat-detect-hidden","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/aystat-detect-hidden\/","author":23550063,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.5","stable_tag":"1.0.5","tested":"7.1.4","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"Aystat Detect Hidden","header_author":"Aystat","header_description":"Detect hidden users, stealth backdoors, concealed posts, hidden plugins, mu-plugins, and drop-ins via differential database and filesystem auditing.","last_updated":"2026-11-13 12:33:49","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/aystat.com","header_plugin_uri":"https:\/\/aystat.com\/detect-hidden","header_author_uri":"https:\/\/aystat.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":149,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.4":{"tag":"1.0.4","author":"stonemanhero","date":"2026-11-12 09:24:49","revision":3797927},"1.0.5":{"tag":"1.0.5","author":"stonemanhero","date":"2026-11-13 12:33:49","revision":3800381}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3797890,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3797890,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3797890,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3797890,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.4","1.0.5"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3800381,"resolution":"1","location":"assets","locale":"","width":2173,"height":1059},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3800381,"resolution":"2","location":"assets","locale":"","width":2173,"height":1369}},"screenshots":{"1":"Clean state \u2013 security audit dashboard ready to scan.","2":"Threat detection results \u2013 differential scan exposing hidden components, cloaked users, and hook interceptors."}},"plugin_section":[],"plugin_tags":[8533,8646,292202,600,292203],"plugin_category":[54],"plugin_contributors":[281023],"plugin_business_model":[],"class_list":["post-397629","plugin","type-plugin","status-publish","hentry","plugin_tags-audit","plugin_tags-backdoor","plugin_tags-hidden-users","plugin_tags-security","plugin_tags-stealth-malware","plugin_category-security-and-spam-protection","plugin_contributors-stonemanhero","plugin_committers-stonemanhero"],"banners":{"banner":"https:\/\/ps.w.org\/aystat-detect-hidden\/assets\/banner-772x250.png?rev=3797890","banner_2x":"https:\/\/ps.w.org\/aystat-detect-hidden\/assets\/banner-1544x500.png?rev=3797890","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/aystat-detect-hidden\/assets\/icon-128x128.png?rev=3797890","icon_2x":"https:\/\/ps.w.org\/aystat-detect-hidden\/assets\/icon-256x256.png?rev=3797890","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/aystat-detect-hidden\/assets\/screenshot-1.png?rev=3800381","caption":"Clean state \u2013 security audit dashboard ready to scan."},{"src":"https:\/\/ps.w.org\/aystat-detect-hidden\/assets\/screenshot-2.png?rev=3800381","caption":"Threat detection results \u2013 differential scan exposing hidden components, cloaked users, and hook interceptors."}],"raw_content":"\n

Aystat Detect Hidden<\/strong> is an advanced security auditing and threat remediation plugin designed to expose stealth malware, backdoor administrators, concealed posts, hidden doorway pages, and clandestine plugins.<\/p>\n\n

The Problem: Hook-Based Cloaking<\/h3>\n\n

Modern WordPress malware rarely modifies core files directly. Instead, sophisticated attackers and backdoors insert malicious users or content into your database and hook into WordPress filter APIs to keep them invisible:\n* Hidden Users:<\/strong> Malware adds a rogue administrator account to the wp_users<\/code> database table, then registers a hook on pre_user_query<\/code> to filter its own ID out of all standard WordPress queries. To the site owner browsing \/wp-admin\/users.php<\/code>, the user list appears normal. Malware often also filters views_users<\/code> to tamper with displayed user counter tallies.\n* Concealed Posts & Doorway Pages:<\/strong> Attackers insert SEO spam, phishing forms, or doorway pages into wp_posts<\/code>, then manipulate pre_get_posts<\/code> or posts_where<\/code> so the posts never appear in the WordPress Admin post list.\n* Concealed Plugins:<\/strong> Rogue plugins or backdoors hook into the all_plugins<\/code> filter to hide themselves from the \/wp-admin\/plugins.php<\/code> interface while continuing to execute on every HTTP request.<\/p>\n\n

The Solution: Differential Auditing & Hook Inspection<\/h3>\n\n

Aystat Detect Hidden bypasses hooked filters through deep differential comparison and multi-layered defense-in-depth:\n1. User Differential Audit:<\/strong> Fetches visible users via standard get_users()<\/code> queries and compares them against raw database rows queried directly from {$wpdb->users}<\/code> and {$wpdb->usermeta}<\/code>. Any user record present in the raw database but excluded from get_users()<\/code> is immediately flagged.\n2. Post & Page Differential Audit:<\/strong> Executes WP_Query<\/code> with active filters and compares returned IDs against raw database records from {$wpdb->posts}<\/code>. Any post or page omitted from the API query is flagged.\n3. Plugin & Component Audit:<\/strong> Physically inspects the plugins directory via DirectoryIterator<\/code> (supporting subdirectories, single-file plugins, and unmanaged standalone PHP scripts) and compares physical files against filtered all_plugins<\/code> hook output.\n4. MU-Plugin & Core Drop-in Inspection:<\/strong> Enumerates all active Must-Use plugins and core architectural drop-ins in the content directory, highlighting high-privilege drop-ins (db.php<\/code>, object-cache.php<\/code>) with elevated security advisories.\n5. Enhanced Hook & Query Inspector:<\/strong> Leverages PHP Reflection to analyze callbacks on sensitive filters (query<\/code>, pre_user_query<\/code>, all_plugins<\/code>, posts_where<\/code>), revealing exact file paths, declaration line numbers, and anonymous closures.<\/p>\n\n

Advanced Edition Upgrades<\/h3>\n\n

Need 1-click threat remediation and autonomous background monitoring? Aystat Detect Hidden Advanced adds:\n* 1-Click Safe Remediation:<\/strong> Instantly delete rogue users (with active-admin protection), trash spam posts, and delete unauthorized backdoor files with strict path traversal safeguards.\n* False-Positive Whitelisting:<\/strong> Ignore approved exceptions (custom tools or intentional drop-ins) with a single click, keeping your audit reports clean.\n* Autonomous 24\/7 Background Scans:<\/strong> Scheduled WP-Cron runner with configurable scan frequencies.\n* Smart State-Diff Email Alerts:<\/strong> Zero email fatigue \u2014 alerts dispatched only when new threats appear.\n* Priority Security Support:<\/strong> Direct developer assistance and priority updates.<\/p>\n\n\n

    \n
  1. Upload the aystat-detect-hidden<\/code> folder to the \/wp-content\/plugins\/<\/code> directory, or install directly through the WordPress plugin installer.<\/li>\n
  2. Activate the plugin through the 'Plugins' screen in WordPress.<\/li>\n
  3. Navigate to Tools > Detect Hidden<\/strong> in your WordPress admin menu.<\/li>\n
  4. Click Run Security Audit<\/strong> to execute a full differential analysis.<\/li>\n<\/ol>\n\n\n
    \n

    Does this plugin affect frontend site speed?<\/h3><\/dt>\n

    No. Audits execute only when an administrator triggers a scan in the admin dashboard. Zero queries or hooks are added to front-end visitor traffic.<\/p><\/dd>\n

    What makes this scanner different from other security plugins?<\/h3><\/dt>\n

    Standard security plugins ask WordPress APIs for lists of users and plugins. If stealth malware has hooked pre_user_query<\/code> or all_plugins<\/code>, standard plugins are blinded by the same hooks. Aystat Detect Hidden queries the database tables and filesystem directly to uncover hidden discrepancies.<\/p><\/dd>\n

    What is the difference between Free and Advanced?<\/h3><\/dt>\n

    The Free version on WordPress.org provides 100% complete differential auditing across users, posts, plugins, drop-ins, and hook inspection. The separate Advanced edition adds 1-click automated threat deletion (users, posts, plugin files), false-positive whitelisting, and 24\/7 background WP-Cron scans with smart email alerts.<\/p><\/dd>\n\n<\/dl>\n\n\n

    1.0.5<\/h4>\n\n
      \n
    • Moved Hook & Query Interception Inspector to a dedicated dashboard tab located between Plugins and Advanced Edition.<\/li>\n
    • Hook and query driver inspections are now strictly informational diagnostics and no longer count toward active threats or auditing status.<\/li>\n
    • Removed severity rankings and security risk warnings from Hook Inspector to display a clean, transparent inventory of all registered callbacks.<\/li>\n
    • Added dedicated Hook Inspector empty state and live tab badge counter.<\/li>\n
    • Updated User Guide, contextual Help tabs, and documentation to reflect informational hook diagnostics.<\/li>\n<\/ul>\n\n

      1.0.4<\/h4>\n\n
        \n
      • Added Enhanced Hook & Query Interception Inspector using PHP Reflection: extracts exact file paths, line numbers, closure detection, and provenance classification.<\/li>\n
      • Added actionable Threats Found card navigation with automatic tab switching and smooth scrolling to flagged items.<\/li>\n
      • Added False-Positive Whitelist (Ignore\/Unignore) feature to approve legitimate exceptions.<\/li>\n
      • Added Clear Scan Snapshot action to reset cached scan states safely.<\/li>\n
      • Updated file and directory path resolution to use core WordPress path functions.<\/li>\n
      • Removed all locked\/premium-gated code to ensure 100% free, unrestricted functionality in the WordPress.org edition.<\/li>\n<\/ul>\n\n

        1.0.3<\/h4>\n\n
          \n
        • Added defense-in-depth low-level SQL query filter isolation to defeat in-memory query rewrites.<\/li>\n
        • Added critical alert detection for active hooks on the WordPress query<\/code> filter.<\/li>\n
        • Added unmanaged standalone PHP script and headerless plugin directory detection.<\/li>\n
        • Added elevated security warning badge and advisories for db.php<\/code> and object-cache.php<\/code> drop-ins.<\/li>\n
        • Added runtime database driver class integrity checks.<\/li>\n<\/ul>\n\n

          1.0.2<\/h4>\n\n
            \n
          • Added perceptible live scanning states and execution time reporting.<\/li>\n
          • Added persistent audit state on page reload.<\/li>\n
          • Scalability optimizations for databases with 30,000+ users and high post counts.<\/li>\n<\/ul>\n\n

            1.0.1<\/h4>\n\n
              \n
            • Enhanced button flex layout and Dashicons alignment to prevent line-wrapping.<\/li>\n<\/ul>\n\n

              1.0.0<\/h4>\n\n
                \n
              • Initial public release with differential user, post, and plugin auditing.<\/li>\n<\/ul>","raw_excerpt":"Detects hidden users, stealth backdoors, hidden posts\/pages, hidden plugins, mu-plugins, and drop-ins through differential auditing.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/397629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=397629"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/stonemanhero"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=397629"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=397629"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=397629"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=397629"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=397629"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=397629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}