Aystat Detect Hidden is an advanced security auditing and threat remediation plugin designed to expose stealth malware, backdoor administrators, concealed posts, hidden doorway pages, and clandestine plugins.

The Problem: Hook-Based Cloaking

Modern WordPress malware rarely modifies core files directly. Instead, sophisticated attackers and backdoors insert malicious users or content into your database and hook into WordPress filter APIs to keep them invisible:
* Hidden Users: Malware adds a rogue administrator account to the wp_users database table, then registers a hook on pre_user_query to filter its own ID out of all standard WordPress queries. To the site owner browsing /wp-admin/users.php, the user list appears normal. Malware often also filters views_users to tamper with displayed user counter tallies.
* Concealed Posts & Doorway Pages: Attackers insert SEO spam, phishing forms, or doorway pages into wp_posts, then manipulate pre_get_posts or posts_where so the posts never appear in the WordPress Admin post list.
* Concealed Plugins: Rogue plugins or backdoors hook into the all_plugins filter to hide themselves from the /wp-admin/plugins.php interface while continuing to execute on every HTTP request.

The Solution: Differential Auditing & Hook Inspection

Aystat Detect Hidden bypasses hooked filters through deep differential comparison and multi-layered defense-in-depth:
1. User Differential Audit: Fetches visible users via standard get_users() queries and compares them against raw database rows queried directly from {$wpdb->users} and {$wpdb->usermeta}. Any user record present in the raw database but excluded from get_users() is immediately flagged.
2. Post & Page Differential Audit: Executes WP_Query with active filters and compares returned IDs against raw database records from {$wpdb->posts}. Any post or page omitted from the API query is flagged.
3. Plugin & Component Audit: Physically inspects the plugins directory via DirectoryIterator (supporting subdirectories, single-file plugins, and unmanaged standalone PHP scripts) and compares physical files against filtered all_plugins hook output.
4. MU-Plugin & Core Drop-in Inspection: Enumerates all active Must-Use plugins and core architectural drop-ins in the content directory, highlighting high-privilege drop-ins (db.php, object-cache.php) with elevated security advisories.
5. Enhanced Hook & Query Inspector: Leverages PHP Reflection to analyze callbacks on sensitive filters (query, pre_user_query, all_plugins, posts_where), revealing exact file paths, declaration line numbers, and anonymous closures.

Advanced Edition Upgrades

Need 1-click threat remediation and autonomous background monitoring? Aystat Detect Hidden Advanced adds:
* 1-Click Safe Remediation: Instantly delete rogue users (with active-admin protection), trash spam posts, and delete unauthorized backdoor files with strict path traversal safeguards.
* False-Positive Whitelisting: Ignore approved exceptions (custom tools or intentional drop-ins) with a single click, keeping your audit reports clean.
* Autonomous 24/7 Background Scans: Scheduled WP-Cron runner with configurable scan frequencies.
* Smart State-Diff Email Alerts: Zero email fatigue — alerts dispatched only when new threats appear.
* Priority Security Support: Direct developer assistance and priority updates.