Aystat Detect Hidden
Differential database and filesystem forensic scanner designed to expose stealth malware, backdoor administrators, and cloaked doorway pages.
Modern WordPress malware rarely modifies core files. Instead, sophisticated backdoors insert malicious users or SEO spam directly into your database and hook into WordPress filter APIs (pre_user_query, all_plugins, pre_get_posts) so they remain completely invisible on standard admin screens.
Zero-Trust Forensic Core
Direct SQL & Filesystem vs. Active Filters
get_users()
WP_Query
all_plugins
db.php & object-cache.php
Production Interface & Scan Results
High-resolution capture of live differential audit telemetry, active query tampering alerts, and itemized threat remediation.
Live Differential Security Audit Dashboard
Production WordPress environment scan comparing raw database records against filtered WordPress API outputs. In this real live audit, the differential engine flagged 2 concealed threats (1 hidden post and 1 cloaked plugin) alongside 1 critical hook interception and 4 warning query filters actively tampering with core queries.
Key Capabilities Demonstrated in the Scan
How the scanner systematically catches anomalies that standard antivirus and security plugins fail to detect.
Active Hook & Query Interception Monitor
Inspects WordPress's runtime hook registry ($wp_filter) to identify stealth filters actively tampering with SQL queries. Detects filters hooking into pre_user_query, posts_where, and all_plugins before results reach admin dashboard tables.
Ghost Administrator Exposing Engine
Compares raw database records from wp_users directly against get_users() API output. If a rogue administrator exists in the database but disappears from the WordPress Users screen due to hook tampering, it is flagged immediately for one-click remediation.
Physical Directory & Unmanaged Script Audit
Iterates physically through wp-content/plugins and mu-plugins using PHP's native DirectoryIterator to uncover unmanaged scripts, orphaned drop-ins, and clandestine plugins omitted from standard plugin manifests.
Granular Remediation & False-Positive Whitelisting
Provides safe, itemized remediation actions directly from the audit screen. Allows administrators to safely trash cloaked posts, delete unauthorized admin users, or permanently whitelist verified internal scripts and legitimate MU-plugins with a single click.
Need specialized WordPress security or custom plugin engineering?
I develop custom forensic scanners, database audit utilities, and high-performance WordPress tools for complex production setups.
How Differential Auditing Works
Bypassing hooked WordPress filter cloaks through direct database queries and raw filesystem introspection.
Raw $wpdb vs. get_users()
Executes a low-level query on {$wpdb->users} and {$wpdb->usermeta} completely uninfluenced by WordPress query filters. Compares IDs against standard get_users() to instantly expose accounts hidden via pre_user_query or views_users.
Concealed Doorway Posts
Queries {$wpdb->posts} directly and cross-references returned records with WP_Query results. Detects malicious SEO doorway pages, concealed phishing templates, or cloaked pages excluded via posts_where.
DirectoryIterator Filesystem Scan
Scans WP_PLUGIN_DIR physically using PHP's native DirectoryIterator. Catches rogue plugins and unmanaged standalone scripts that hook into all_plugins to vanish from the WordPress Admin plugins table.
Drop-in & MU-Plugin Forensics
Audits high-privilege architectural drop-in files (db.php, object-cache.php, sunrise.php) that execute before standard plugins load, highlighting risks with elevated security advisories.
Technical Specifications
Key compatibility details and operational parameters.
| WordPress Compatibility | Version 5.8 through 7.1+ |
|---|---|
| PHP Version Support | PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5+ |
| Database Engines | MySQL 5.7+, MariaDB 10.3+, Percona |
| Detection Scope | Hidden administrators, doorway posts, stealth plugins, unmanaged PHP scripts, MU-plugins, architectural drop-ins |
| Safety Safeguards | Active-admin protection, content re-assignment, path-traversal validation, safe trash restoration |
| Plugin Availability | Private Release • Custom WordPress Security Engineering |
Need custom WordPress security or plugin engineering?
I build custom security solutions, perform differential database audits, and develop high-performance WordPress tools.