Skip to content
MP MD Pabel WordPress security

WordPress Malware Research Entry

hide-hidden-posts.php MU-Plugin and Concealed Post IDs

Casino or foreign-language posts appeared on WordPress but are missing from the Posts screen? See evidence of hidden post IDs and altered admin counts.

Reviewed: July 22, 2026
Artifact class Post-concealment MU plugin
Evidence confidence High
Risk assessment Medium

Start with the problem you are seeing

Could this match the problem on your WordPress site?

This investigation is relevant when spam posts are publicly reachable or appear in search results but cannot be found normally in wp-admin. A must-use plugin filtered selected post IDs and adjusted administrative post counts.

Observed in this investigation

  • The investigation retained a public casino-themed post and code that excluded selected post IDs from administrative queries and counts.

Possible warning signs

  • Spam posts can be visible publicly or in search results while missing from the normal Posts list.
  • The post count shown in wp-admin may not match the rows an administrator can see.

These signs are investigation leads, not proof of this artifact by themselves.

Questions this research can help answer

  • Why are casino posts on my WordPress site but not in the Posts screen?
  • Can a must-use plugin hide spam posts from WordPress administrators?

Evidence boundary: The retained code supports administrative concealment; it does not identify how the spam records were first created.

Seeing one of these signs on your site?

I can investigate the files, database records, users, and server evidence, explain what is confirmed, and help plan a safe cleanup.

Ask me to investigate your site See how my malware cleanup works

Research focus: Forensic review of an MU-plugin that read apft_hidden_post_ids and removed selected posts from queries and published counts.

Summary

This WordPress malware research entry documents post-concealment mu plugin evidence observed during one anonymized client investigation. The narrow topic is hide-hidden-posts.php MU-Plugin and Concealed Post IDs: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The code is designed to conceal selected posts from administrative queries and counts. It could hide unwanted content, but creation of the visible casino post is not shown in this sample.

Investigation context

Anonymized investigation with an MU-plugin directory screenshot, a visible casino post screenshot, and retained hide-hidden-posts.php code. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

hide-hidden-posts.php existed in the MU-plugin directory.

WordPress file manager showing hide-hidden-posts.php inside the mu-plugins directory
The file manager confirms hide-hidden-posts.php beside db.php and mu-helper.php in mu-plugins. It does not identify which component created any spam post.

Casino-related content was visible during the investigation.

Rendered WordPress post displaying Italian casino-related text
A casino-related post was visible during the same anonymized investigation. The screenshot confirms the content symptom, not that hide-hidden-posts.php created it.

Confirmed findings

  • The file was present under wp-content/mu-plugins.
  • apft_get_hidden_ids reads apft_hidden_post_ids and converts values to integers.
  • pre_get_posts adds those IDs to post__not_in under the coded conditions.
  • wp_count_posts reduces the published count for matching IDs.

Technical analysis

How apft_hidden_post_ids changes post visibility

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

$ids = get_option('apft_hidden_post_ids', []);
// validated IDs are merged into post__not_in
$query->set('post__not_in', $ids);
// count-adjustment query details shortened

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The code is designed to conceal selected posts from administrative queries and counts. It could hide unwanted content, but creation of the visible casino post is not shown in this sample.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

  • hide-hidden-posts.php
  • apft_hidden_post_ids
  • apft_get_hidden_ids
  • post__not_in plus wp_count_posts adjustment

Contextual indicators

  • mu-plugins
  • pre_get_posts
  • wp_count_posts
  • casino-related post

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

  • The evidence does not show which code created the casino post.
  • The relationship between db.php, mu-helper.php, and hide-hidden-posts.php was not established.
  • The initial compromise method and selected option values were not retained.

Artifact-specific remediation

  • Preserve the MU-plugin and option value before changes.
  • Remove the untrusted file and review every neighboring MU-plugin against a known baseline.
  • Identify the selected post IDs directly in the database and review their authors, content, and status.
  • Remove unauthorized content only after preserving needed evidence.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

  • Confirm apft_hidden_post_ids does not return.
  • Compare direct database post counts with wp-admin counts.
  • Monitor mu-plugins and post records for recreation.

Browse the WordPress malware research hub.

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.