# Nova Heaven — Full Content Dump > This file contains the full text of every Nova Heaven blog post and codex doc, concatenated for AI ingestion. For the brand overview, products, and comparisons see https://novaheaven.io/llms.txt Generated: 2026-04-22 Total posts: 9 Total docs: 8 --- # Nova Pulse (Blog) ## WordPress Security Checklist: 15 Checks That Actually Matter (And 12 That Don't) URL: https://novaheaven.io/en/novapulse/wordpress-security-checklist-that-matters Published: 2026-04-17 Author: SephX, Nova Heaven Quick answer: If you do only three things to secure WordPress: turn on 2FA for every admin account, enable auto-updates for minor core and plugin releases, and back up to a location outside your hosting account. Those three stop roughly 85% of real attacks. Twelve common checklist items do not matter: renaming the admin username, changing the wp_ table prefix, hiding the WordPress version, renaming wp-login.php, blocking traffic from China or Russia, and eight others are security theater that waste attention on the controls above. I've been maintaining WordPress sites for 25 years. I've read maybe 400 security checklists in that time, and the ones that top Google today are mostly padded for length. They list "rename your admin account" next to "enable 2FA" as if those two are comparable defenses. Only one of those two things actually stops attacks in 2026. The other stops attacks from 2011, and renaming an admin account hasn't been meaningful security in over a decade. What follows is the stripped-down version. 15 checks that meaningfully reduce your attack surface on a modern WordPress install, and 12 popular ones I'm throwing out because they're theater. The 15 That Matter 1. Turn on 2FA for every admin account. This is the single highest-ROI security control on WordPress. Credential-stuffing attacks compromise thousands of sites a week, and 2FA stops every one of them dead. Use an authenticator app, not SMS. 2. Use unique, long admin passwords. Password manager, 20 characters or more, never reused anywhere else. This matters even with 2FA, because 2FA can be bypassed on recovery flows. The password has to be the second wall, not the first. 3. Update core within 7 days of any minor release. Minor releases are security patches. Sitting on them for weeks is how known-CVE attacks land on your site. Enable auto-updates for minor versions and be done with it. 4. Update plugins within 7 days of any patch release, same logic. Most WordPress compromises in the last 3 years trace back to an unpatched plugin CVE that had a fix available for weeks before the attacker arrived. 5. Remove every plugin you're not actively using. Deactivated is not removed. Deactivated plugins still get scanned by attackers and still contain exploitable code. If it's not running, delete it. Deactivated is not removed. 6. Remove every theme except the active one, same reason. twentytwentyone sitting unused in your themes directory is attack surface for nothing. 7. Host with a provider that isolates accounts. Shared hosting without account isolation means one infected neighbor site can walk into yours. SiteGround, Kinsta, WP Engine, Rocket, and Hostinger's Business tier all isolate properly. Avoid anything that doesn't. 8. Turn off file editing in the admin. Add define('DISALLOW_FILE_EDIT', true); to wp-config. If an admin account is compromised, the attacker can't drop a webshell through the UI. 9. Limit login attempts, and do it right. A plugin that only tracks IPs gets bypassed by rotating proxies. You want one that also limits per username. That rate-limits the credential-stuffer regardless of how many IPs they cycle through. 10. Move wp-config.php above the webroot, or at minimum protect it via .htaccess . The default install leaves it readable if PHP execution ever breaks, which happens during migrations, plugin conflicts, and PHP upgrades. 11. Force HTTPS everywhere and turn HSTS on. The reason isn't Google's ranking signal. It's that HTTP admin sessions leak cookies to any Wi-Fi sniffer. Set FORCE_SSL_ADMIN in wp-config and serve HSTS headers with a 6-month max-age. 12. Back up to a location outside your hosting account. If your hosting account gets compromised, in-account backups go with it. UpdraftPlus to your own S3, R2, or Dropbox, or use a hosting-tier offsite backup service. 13. Run regular malware scans that include file integrity checks. Pattern matching alone misses every tailored injection. Scans should compare your core and plugin files against known-good hashes, which catches modifications no signature database will. 14. Monitor for new admin users. Attackers create backup admin accounts for persistence. Any new admin account should fire an email to you, not just appear silently in the users list. 15. Turn off XML-RPC if you don't use it. If you don't use the Jetpack app, the WordPress iOS or Android app, or Pingbacks, xmlrpc.php is just an attack amplifier. Block it at the webserver level, not via plugin. That's the list. Fifteen items. Do all fifteen and you're ahead of 97% of WordPress sites on the internet. The 12 That Don't Matter (And Why) "Change the admin username from admin ." WordPress hasn't defaulted to that username since version 3.0 in 2010. Your username isn't a secret, it's visible in the /?author=1 URL. This is security-through-obscurity where there's no obscurity to begin with. "Change the database table prefix from wp_ ." Any SQL injection that can read your tables can also read your wp_options table, or your xyz_options table. The prefix doesn't slow the attack by one second. It just breaks plugin compatibility. "Hide the WordPress version number." The attacker doesn't care what your meta generator tag says. They probe for a vulnerable plugin directly. Version fingerprinting is trivially bypassable and doesn't gate any real attack. "Rename the wp-login.php URL." You can move the login to /my-secret-login . Attackers who care enough to target your site will find it in the HTML of any page that links to it, or via any of 14 other WordPress-specific fingerprints. It stops bulk scanners, not targeted attacks. If you want to stop bulk scanners, rate-limit instead. "Disable directory browsing." Disable it, sure, but no attack hinges on directory listings in 2026. Attackers use vulnerability databases now, not filesystem walks. "Limit access to wp-admin by IP." Works until your ISP rotates your IP, you travel, or your one contractor needs access. The failure mode is "admin locks self out at 2am." Not worth the operational cost for the marginal benefit. "Disable PHP execution in uploads directory." Worth doing, but if you got to the point where an attacker wrote a PHP file into uploads, they already bypassed something more important. It's a safety net, not a primary control. "Install 7 security plugins." One quality security plugin plus one malware scanner is enough. Seven of them means conflicts, performance drag, and redundant detections. More plugins equals more code equals more attack surface. "Block all traffic from China and Russia." Attacker infrastructure is global. The IPs hitting your login endpoint live in AWS, Digital Ocean, OVH, and residential proxies in Brazil. A single geo filter won't stop the volume. And you lose legitimate international readers. "Scan daily." Malware scans take resources and clutter your inbox with false positives. Weekly is fine for most sites. Continuous file-change monitoring is better than frequent full scans anyway. "Disable REST API for non-authenticated users." Breaks more plugins than you'd expect. Gutenberg, some caching plugins, and block editor metadata all rely on REST. The real answer is to audit which endpoints are exposed, not to kill the whole surface. "Use a WAF from [vendor]." A WAF is a real answer for enterprise. For most WordPress sites, the WAF's value is negated by the fact that an unpatched plugin will be exploited before any WAF signature covers the CVE. Patch cadence beats WAF every time. The Real Ranking If I could only recommend three things to a new WordPress site owner, they'd be these, in this order: 2FA on all admins, auto-updates for minor core and plugins, and backups to a location outside your host. Those three stop 85% of what happens to WordPress sites. Every additional item on the 15-list closes a specific edge case. Every item on the 12-list steals attention from the real defenses. Checklists are a credibility game for the writer. Nova Heaven Security The value for you is in knowing which items actually move the dial, and which items a padding-for-length piece put in front of you to look thorough. Every item on the 12-list steals attention from the real defenses. Nova Scan handles all items from the real list, which are integrity-based malware scanning and new-admin alerts, without needing a paid tier. nova scan overview . ~ SephX, Nova Heaven. Three real defenses beat fifteen checkboxes every time. --- ## Why Your WordPress Site Redirects to Spam Sites (And How to Find What's Doing It) URL: https://novaheaven.io/en/novapulse/wordpress-hacked-redirect Published: 2026-04-17 Author: SephX, Nova Heaven Quick answer: A WordPress site that redirects visitors to spam (but not you) is a conditional redirect injection. The redirect hides in one of six places: .htaccess, wp-config.php, theme functions.php, wp_options, wp_posts, or a modified active-plugin file. Find it by viewing source before the redirect fires, testing with curl using a Googlebot user-agent and referrer, and checking the database for injected On the surface it looks like a Google Analytics script loading from a CDN, with a domain name crafted to sound legitimate. But jquery-analytics.example has nothing to do with jQuery or analytics. It's a script that harvests form data, including login credentials, payment information, and personal details, and sends it to the attacker's server. This kind of injection is invisible to any scanner that only checks files because the filesystem is completely clean. The malware lives in a single database row, injected through a vulnerability months ago, silently skimming data from every visitor. Nova Scan checks your database for exactly these patterns, including scripts loading from unknown external domains, inline JavaScript with obfuscation, and injected iframes that don't belong in your content. 6. The Legitimate Plugin Backdoor This category is the one that keeps me up at night, because attackers don't always upload new files. They often modify files that already exist, and a single added line is enough. Picture a single line added to the bottom of wp-content/plugins/contact-form-7/includes/mail.php : @include_once(ABSPATH . 'wp-content/uploads/2024/03/.cache.php'); That's the whole change. One line appended to a legitimate plugin file, including a file hidden in the uploads directory. Uploads is a directory that WordPress doesn't monitor for PHP execution by default, the dot-prefix makes the file hidden on Linux systems, and the .cache.php name makes it look like a caching artifact if anyone ever stumbles across it. Contact Form 7 has 5 million installs, which means most site owners would never think to check its source code because they installed it from wordpress.org and trusted it was safe. The attacker is betting that you update plugins by clicking "Update" in the dashboard, which overwrites the files and removes their modification. But the included file in /uploads/ survives the update, and the next time the attacker finds another vulnerability they'll add that one line right back. 7. The Invisible Admin Sometimes the malware isn't a file or a database row at all, but a user account. I've cleaned sites where the attacker's first move was to create a WordPress administrator account with a username like wordpress_support or wpsec_update , names that look like they belong to a plugin or service. The account then sits there, unused, invisible in the user list if you have more than a handful of users and don't scroll far enough. No code gets modified and no payload gets planted. The attacker simply has a legitimate admin account they can log into whenever they want, through the front door, with full privileges. If you clean the malware but skip auditing your user list, they walk right back in the next day. Nova Scan flags rogue administrator accounts as part of its database audit, so if an admin account was created outside of your normal registration flow, or if its email domain doesn't match your site's domain, you'll know about it the next time you scan. What All of These Have in Common Every example above shares three traits. They all look like they belong, whether as fake core files, modified plugin files, or database content, because nothing in any of these examples screams "I'm malware" and that invisibility is the entire point of how they're written. They all evade signature scanning, since the variable construction, runtime payloads, and conditional execution mean the dangerous behavior only exists when the code runs and not when a scanner reads it from disk. And they all persist through cleanups, because database injections survive file restores, upload directory backdoors survive plugin updates, and rogue admin accounts survive almost everything. Attackers design for persistence because they know you'll eventually notice something is wrong, and their goal is to survive your response. How to Actually Find This Stuff If you take one thing from this post, let it be that a scanner which only matches known signatures is going to miss most of what's actually out there. Modern WordPress malware is specifically engineered to evade exactly that approach. What you need instead is behavioral analysis that understands what code does rather than what it looks like, combined with database scanning rather than filesystem-only scanning, and integrity checking against known-good WordPress core files. All of that needs to be accessible without a $99/year subscription, because attackers don't check your budget before they compromise your site. That's why I built Nova Scan . It's free forever, every finding is shown in full, and there's no premium tier hiding the details of your own site's security from you. Install it, run a scan, and see what's actually hiding in your WordPress installation. The malware that actually costs sites their reputation and their traffic isn't the kind that breaks things visibly. It's the kind that leaves everything looking fine while doing whatever it wants behind your back, and that is exactly what Nova Scan is built to find. ~ SephX, Nova Heaven. Still cleaning up messes, still refusing to charge you for the privilege of knowing about them. --- ## Why My First WordPress Plugin Is a Free Malware Scanner URL: https://novaheaven.io/en/novapulse/why-my-first-wordpress-plugin-is-a-free-malware-scanner Published: 2026-04-10 Author: SephX, Nova Heaven I've been building WordPress sites for 25 years. I've watched the ecosystem go from a bloggers' toy to the backbone of 43% of the internet, seen trends come and go, plugins rise and fall, and security threats evolve from script-kiddie defacements to nation-state-grade supply chain attacks. Through all of it, one thing has stayed frustratingly constant: the security tools that are supposed to protect you are bad at their job. The Day My Site Got Hacked (While "Protected") There was one specific client cleanup that made me start building Nova Scan. It was a small business site, nothing fancy, running the paid version of Wordfence. The dashboard was a symphony of reassurance, with green checkmarks everywhere, "firewall optimized," and "scan complete: no issues found." The site was also completely owned, with three backdoors running at the same time while the most popular security plugin in the WordPress ecosystem was showing everything clear. What Wordfence Missed Here is what I found when I actually looked at the files. Backdoor #1: The Impersonator A file called wp-content/db.php . WordPress legitimately supports drop-in database files at that path, so Wordfence looked at it and decided everything was normal. It wasn't. Inside was a single line using PHP's zip:// stream wrapper to pull executable code out of a hidden zip file. The file contained none of the strings signature scanners look for. It was using a legal PHP function to do something clearly illegal, and that single line was all the attacker needed. Backdoor #2: The Nesting Doll Six directories deep: .private/mu-plugins/widgets/twentytwentyfive/Renderer/index.php . That path was specifically crafted to look like a WordPress theme component, but what it actually contained was a full PHP file manager with a hardcoded password, giving the attacker a browser-based GUI to browse, upload, download, and modify any file on the entire server . It amounted to full FTP access through a web browser. Backdoor #3: The Fake Core File A file called wp-check.php sitting in the site root. At first glance it looks like a WordPress core file because the project ships things like wp-cron.php , wp-login.php , and wp-mail.php . But wp-check.php has never existed in any version of WordPress, and this one was a dropper stub planted the same day as the other two, whose only job was downloading and installing whatever payload the attacker wanted to run next. Wordfence didn't flag a single one of them. The Moment I Decided to Build Nova Scan I sat there staring at the Wordfence dashboard giving me an all-green, all-clear "your site is protected" while three backdoors were actively running. The thought that kept circling in my head: A green-light dashboard with three backdoors behind it is a bedtime story people tell themselves so they don't have to check under the bed. I've cleaned dozens of hacked sites over 25 years, and every single one of them was running a security plugin with a clean bill of health while the site was actively compromised. At some point you either keep cleaning up other people's messes forever, or you start building the tool you wish existed. I picked the second option. Why Free? Actually Free? The part of the WordPress security industry that kills me is how thoroughly it has turned fear into a subscription model . "We found 7 critical threats on your site. Upgrade to Premium to see the details." Read that again. They found threats, on your site, and they're hiding the details behind a paywall . That is a hostage situation dressed up as a security product. Your house is on fire and the fire department wants your credit card number before they will tell you which room to avoid. Nova Scan is free forever and stays free. There is no time-limited trial, no hidden premium tier for the real findings, and no "free for 3 scans then $99 a year" bait-and-switch. You get the full detail on every CVE, every suspicious file, and every recommendation, with no upsell nags in the scan results. If your site is hacked you deserve to know exactly how, without having to type in a credit card first. What Makes Nova Scan Different I built Nova Scan because every existing option was missing whatever I was looking for at 2 AM while cleaning up someone else's mess. It Actually Reads the Code Most scanners match filenames and known signatures, which is why they miss things like the db.php backdoor above, because the filename is "safe." Nova Scan doesn't care what a file is called. It reads the code inside, analyzes the behavior, and decides whether the file is malicious based on what it does rather than what it happens to be named. Machine Learning That Earns Its Keep I built a machine learning engine trained on real-world malware samples, backdoors, and skimmers, which scores every file based on behavioral patterns and catches obfuscated code, zero-day variants, and novel attack patterns that signature-based scanners have never seen. The detection intelligence is encrypted at rest, so attackers cannot read our playbook even if they get file access to your site. Database Scanning That Understands Context Your database can be just as compromised as your filesystem, whether through injected JavaScript in post content, rogue admin accounts, or malicious cron jobs. Nova Scan checks all of it, and it is smart enough to know the difference between a page builder storing in a post field and an attacker injecting . 27,000+ CVEs, No API Key Required Every plugin and theme on your site gets checked against the Wordfence Intelligence CVE database and the WPScan Vulnerability Database, with known vulnerabilities flagged instantly. There is no premium API key required for the core feed. False Positives? We Obsess Over Them Nothing destroys trust in a scanner faster than crying wolf. We recently ran Nova Scan on an 83,000-file client site and got 500 findings, every single one of them a false positive. Instead of shrugging, we spent days making the detection logic smarter, and that site now shows zero false positives at medium severity or above. Every rule still runs and nothing gets skipped. The scanner got accurate enough to tell the difference between a real threat and a plugin's translation file. What We Just Shipped (The Nerdy Stuff) Here is what went live this week: Vault-encrypted detection intelligence: all signatures, patterns, and rules are encrypted on disk, so if someone gets file access to your site they cannot reverse-engineer the detection logic. 36 YARA threat-hunting rules: integrated from the PHP Malware Finder and Elastic security research, catching obfuscation patterns, known webshell families, and packer signatures. VirusTotal integration: check suspicious file hashes against 70+ antivirus engines with one click. LLM prompt injection detection: in 2026 some attackers are embedding AI prompt injections inside PHP files. We detect 9 different patterns of it. Auto-vPatch CVE rules: the firewall now auto-generates WAF rules from CVE data, so when a new vulnerability gets disclosed, protection can be active before the plugin author even wakes up. Memory and OPcache integrity scanning: because some attacks live entirely in memory and never touch the filesystem. The Philosophy I believe three things about WordPress security: Security shouldn't cost $99 a year. If a scanner exists to protect people, it should protect all people, not just the ones with budget. You should never need a "premium license" to see what's wrong with your own website. That business model is ethically bankrupt. A scanner that shows you a clean report while three backdoors are running is worse than no scanner at all, because it gives you false confidence and makes you stop looking. Nova Scan exists because the alternatives failed me and my clients, and based on the sites I keep getting called in to clean, they are failing you too. Try It Nova Scan is free forever. Create an account, install the plugin, run a scan. If it finds something Wordfence missed, I won't say I told you so, although I might think it a little. Get Nova Scan → Nova Scan is still in early access, maintained by a solo dev, with bugs getting fixed at midnight, but it catches things the big names don't, and that is why it exists. ~ SephX, founder of Nova Heaven. 25 years of WordPress and zero tolerance for paid fear. --- # The Codex (Documentation) ## Nova Shield: Frontend Protection Setup URL: https://novaheaven.io/en/codex/nova-shield-frontend-protection-setup Last updated: 2026-04-07 Nova Shield is the frontend security layer for Nova Scan. It runs as a tiny JavaScript agent on your site, watching for DOM tampering, malicious script injection, and unauthorized form hijacking in real time. What Nova Shield Protects Against 🪞 DOM injection : malicious scripts added after page load 📝 Form hijacking : credit card / login form skimmers 🔗 Link tampering : redirect chain swaps 🧬 Script integrity drift : modifications to your JS files 🎭 Iframe injection : hidden ad/tracking frames 🛰️ Suspicious outbound calls : data exfiltration attempts Quick Setup (3 steps) 1. Enable Shield Nova Core → Nova Scan → Shield → Enable Frontend Protection 2. Pick a Mode Learning Mode (recommended for first 7 days): Shield watches and logs everything but blocks nothing. Use this to baseline your site. Active Mode : Shield blocks anything that doesn't match the learned baseline. 3. Verify the Agent Loaded Open your homepage in an incognito window, open DevTools → Console, and look for: Nova Shield] Active - monitoring 9 surfaces If you see that, you're done. If not, see Troubleshooting below. Configuration Options Setting Default What it does Mode Learning Learning vs Active Protected Pages All Restrict to checkout/login only if needed Form Protection On Watches all