# Nova Heaven — Full Content Dump > This file contains the full text of every Nova Heaven blog post and codex doc, concatenated for AI ingestion. For the brand overview, products, and comparisons see https://novaheaven.io/llms.txt Generated: 2026-04-22 Total posts: 9 Total docs: 8 --- # Nova Pulse (Blog) ## WordPress Security Checklist: 15 Checks That Actually Matter (And 12 That Don't) URL: https://novaheaven.io/en/novapulse/wordpress-security-checklist-that-matters Published: 2026-04-17 Author: SephX, Nova Heaven Quick answer: If you do only three things to secure WordPress: turn on 2FA for every admin account, enable auto-updates for minor core and plugin releases, and back up to a location outside your hosting account. Those three stop roughly 85% of real attacks. Twelve common checklist items do not matter: renaming the admin username, changing the wp_ table prefix, hiding the WordPress version, renaming wp-login.php, blocking traffic from China or Russia, and eight others are security theater that waste attention on the controls above. I've been maintaining WordPress sites for 25 years. I've read maybe 400 security checklists in that time, and the ones that top Google today are mostly padded for length. They list "rename your admin account" next to "enable 2FA" as if those two are comparable defenses. Only one of those two things actually stops attacks in 2026. The other stops attacks from 2011, and renaming an admin account hasn't been meaningful security in over a decade. What follows is the stripped-down version. 15 checks that meaningfully reduce your attack surface on a modern WordPress install, and 12 popular ones I'm throwing out because they're theater. The 15 That Matter 1. Turn on 2FA for every admin account. This is the single highest-ROI security control on WordPress. Credential-stuffing attacks compromise thousands of sites a week, and 2FA stops every one of them dead. Use an authenticator app, not SMS. 2. Use unique, long admin passwords. Password manager, 20 characters or more, never reused anywhere else. This matters even with 2FA, because 2FA can be bypassed on recovery flows. The password has to be the second wall, not the first. 3. Update core within 7 days of any minor release. Minor releases are security patches. Sitting on them for weeks is how known-CVE attacks land on your site. Enable auto-updates for minor versions and be done with it. 4. Update plugins within 7 days of any patch release, same logic. Most WordPress compromises in the last 3 years trace back to an unpatched plugin CVE that had a fix available for weeks before the attacker arrived. 5. Remove every plugin you're not actively using. Deactivated is not removed. Deactivated plugins still get scanned by attackers and still contain exploitable code. If it's not running, delete it. Deactivated is not removed. 6. Remove every theme except the active one, same reason. twentytwentyone sitting unused in your themes directory is attack surface for nothing. 7. Host with a provider that isolates accounts. Shared hosting without account isolation means one infected neighbor site can walk into yours. SiteGround, Kinsta, WP Engine, Rocket, and Hostinger's Business tier all isolate properly. Avoid anything that doesn't. 8. Turn off file editing in the admin. Add define('DISALLOW_FILE_EDIT', true); to wp-config. If an admin account is compromised, the attacker can't drop a webshell through the UI. 9. Limit login attempts, and do it right. A plugin that only tracks IPs gets bypassed by rotating proxies. You want one that also limits per username. That rate-limits the credential-stuffer regardless of how many IPs they cycle through. 10. Move wp-config.php above the webroot, or at minimum protect it via .htaccess . The default install leaves it readable if PHP execution ever breaks, which happens during migrations, plugin conflicts, and PHP upgrades. 11. Force HTTPS everywhere and turn HSTS on. The reason isn't Google's ranking signal. It's that HTTP admin sessions leak cookies to any Wi-Fi sniffer. Set FORCE_SSL_ADMIN in wp-config and serve HSTS headers with a 6-month max-age. 12. Back up to a location outside your hosting account. If your hosting account gets compromised, in-account backups go with it. UpdraftPlus to your own S3, R2, or Dropbox, or use a hosting-tier offsite backup service. 13. Run regular malware scans that include file integrity checks. Pattern matching alone misses every tailored injection. Scans should compare your core and plugin files against known-good hashes, which catches modifications no signature database will. 14. Monitor for new admin users. Attackers create backup admin accounts for persistence. Any new admin account should fire an email to you, not just appear silently in the users list. 15. Turn off XML-RPC if you don't use it. If you don't use the Jetpack app, the WordPress iOS or Android app, or Pingbacks, xmlrpc.php is just an attack amplifier. Block it at the webserver level, not via plugin. That's the list. Fifteen items. Do all fifteen and you're ahead of 97% of WordPress sites on the internet. The 12 That Don't Matter (And Why) "Change the admin username from admin ." WordPress hasn't defaulted to that username since version 3.0 in 2010. Your username isn't a secret, it's visible in the /?author=1 URL. This is security-through-obscurity where there's no obscurity to begin with. "Change the database table prefix from wp_ ." Any SQL injection that can read your tables can also read your wp_options table, or your xyz_options table. The prefix doesn't slow the attack by one second. It just breaks plugin compatibility. "Hide the WordPress version number." The attacker doesn't care what your meta generator tag says. They probe for a vulnerable plugin directly. Version fingerprinting is trivially bypassable and doesn't gate any real attack. "Rename the wp-login.php URL." You can move the login to /my-secret-login . Attackers who care enough to target your site will find it in the HTML of any page that links to it, or via any of 14 other WordPress-specific fingerprints. It stops bulk scanners, not targeted attacks. If you want to stop bulk scanners, rate-limit instead. "Disable directory browsing." Disable it, sure, but no attack hinges on directory listings in 2026. Attackers use vulnerability databases now, not filesystem walks. "Limit access to wp-admin by IP." Works until your ISP rotates your IP, you travel, or your one contractor needs access. The failure mode is "admin locks self out at 2am." Not worth the operational cost for the marginal benefit. "Disable PHP execution in uploads directory." Worth doing, but if you got to the point where an attacker wrote a PHP file into uploads, they already bypassed something more important. It's a safety net, not a primary control. "Install 7 security plugins." One quality security plugin plus one malware scanner is enough. Seven of them means conflicts, performance drag, and redundant detections. More plugins equals more code equals more attack surface. "Block all traffic from China and Russia." Attacker infrastructure is global. The IPs hitting your login endpoint live in AWS, Digital Ocean, OVH, and residential proxies in Brazil. A single geo filter won't stop the volume. And you lose legitimate international readers. "Scan daily." Malware scans take resources and clutter your inbox with false positives. Weekly is fine for most sites. Continuous file-change monitoring is better than frequent full scans anyway. "Disable REST API for non-authenticated users." Breaks more plugins than you'd expect. Gutenberg, some caching plugins, and block editor metadata all rely on REST. The real answer is to audit which endpoints are exposed, not to kill the whole surface. "Use a WAF from [vendor]." A WAF is a real answer for enterprise. For most WordPress sites, the WAF's value is negated by the fact that an unpatched plugin will be exploited before any WAF signature covers the CVE. Patch cadence beats WAF every time. The Real Ranking If I could only recommend three things to a new WordPress site owner, they'd be these, in this order: 2FA on all admins, auto-updates for minor core and plugins, and backups to a location outside your host. Those three stop 85% of what happens to WordPress sites. Every additional item on the 15-list closes a specific edge case. Every item on the 12-list steals attention from the real defenses. Checklists are a credibility game for the writer. Nova Heaven Security The value for you is in knowing which items actually move the dial, and which items a padding-for-length piece put in front of you to look thorough. Every item on the 12-list steals attention from the real defenses. Nova Scan handles all items from the real list, which are integrity-based malware scanning and new-admin alerts, without needing a paid tier. nova scan overview . ~ SephX, Nova Heaven. Three real defenses beat fifteen checkboxes every time. --- ## Why Your WordPress Site Redirects to Spam Sites (And How to Find What's Doing It) URL: https://novaheaven.io/en/novapulse/wordpress-hacked-redirect Published: 2026-04-17 Author: SephX, Nova Heaven Quick answer: A WordPress site that redirects visitors to spam (but not you) is a conditional redirect injection. The redirect hides in one of six places: .htaccess, wp-config.php, theme functions.php, wp_options, wp_posts, or a modified active-plugin file. Find it by viewing source before the redirect fires, testing with curl using a Googlebot user-agent and referrer, and checking the database for injected On the surface it looks like a Google Analytics script loading from a CDN, with a domain name crafted to sound legitimate. But jquery-analytics.example has nothing to do with jQuery or analytics. It's a script that harvests form data, including login credentials, payment information, and personal details, and sends it to the attacker's server. This kind of injection is invisible to any scanner that only checks files because the filesystem is completely clean. The malware lives in a single database row, injected through a vulnerability months ago, silently skimming data from every visitor. Nova Scan checks your database for exactly these patterns, including scripts loading from unknown external domains, inline JavaScript with obfuscation, and injected iframes that don't belong in your content. 6. The Legitimate Plugin Backdoor This category is the one that keeps me up at night, because attackers don't always upload new files. They often modify files that already exist, and a single added line is enough. Picture a single line added to the bottom of wp-content/plugins/contact-form-7/includes/mail.php : @include_once(ABSPATH . 'wp-content/uploads/2024/03/.cache.php'); That's the whole change. One line appended to a legitimate plugin file, including a file hidden in the uploads directory. Uploads is a directory that WordPress doesn't monitor for PHP execution by default, the dot-prefix makes the file hidden on Linux systems, and the .cache.php name makes it look like a caching artifact if anyone ever stumbles across it. Contact Form 7 has 5 million installs, which means most site owners would never think to check its source code because they installed it from wordpress.org and trusted it was safe. The attacker is betting that you update plugins by clicking "Update" in the dashboard, which overwrites the files and removes their modification. But the included file in /uploads/ survives the update, and the next time the attacker finds another vulnerability they'll add that one line right back. 7. The Invisible Admin Sometimes the malware isn't a file or a database row at all, but a user account. I've cleaned sites where the attacker's first move was to create a WordPress administrator account with a username like wordpress_support or wpsec_update , names that look like they belong to a plugin or service. The account then sits there, unused, invisible in the user list if you have more than a handful of users and don't scroll far enough. No code gets modified and no payload gets planted. The attacker simply has a legitimate admin account they can log into whenever they want, through the front door, with full privileges. If you clean the malware but skip auditing your user list, they walk right back in the next day. Nova Scan flags rogue administrator accounts as part of its database audit, so if an admin account was created outside of your normal registration flow, or if its email domain doesn't match your site's domain, you'll know about it the next time you scan. What All of These Have in Common Every example above shares three traits. They all look like they belong, whether as fake core files, modified plugin files, or database content, because nothing in any of these examples screams "I'm malware" and that invisibility is the entire point of how they're written. They all evade signature scanning, since the variable construction, runtime payloads, and conditional execution mean the dangerous behavior only exists when the code runs and not when a scanner reads it from disk. And they all persist through cleanups, because database injections survive file restores, upload directory backdoors survive plugin updates, and rogue admin accounts survive almost everything. Attackers design for persistence because they know you'll eventually notice something is wrong, and their goal is to survive your response. How to Actually Find This Stuff If you take one thing from this post, let it be that a scanner which only matches known signatures is going to miss most of what's actually out there. Modern WordPress malware is specifically engineered to evade exactly that approach. What you need instead is behavioral analysis that understands what code does rather than what it looks like, combined with database scanning rather than filesystem-only scanning, and integrity checking against known-good WordPress core files. All of that needs to be accessible without a $99/year subscription, because attackers don't check your budget before they compromise your site. That's why I built Nova Scan . It's free forever, every finding is shown in full, and there's no premium tier hiding the details of your own site's security from you. Install it, run a scan, and see what's actually hiding in your WordPress installation. The malware that actually costs sites their reputation and their traffic isn't the kind that breaks things visibly. It's the kind that leaves everything looking fine while doing whatever it wants behind your back, and that is exactly what Nova Scan is built to find. ~ SephX, Nova Heaven. Still cleaning up messes, still refusing to charge you for the privilege of knowing about them. --- ## Why My First WordPress Plugin Is a Free Malware Scanner URL: https://novaheaven.io/en/novapulse/why-my-first-wordpress-plugin-is-a-free-malware-scanner Published: 2026-04-10 Author: SephX, Nova Heaven I've been building WordPress sites for 25 years. I've watched the ecosystem go from a bloggers' toy to the backbone of 43% of the internet, seen trends come and go, plugins rise and fall, and security threats evolve from script-kiddie defacements to nation-state-grade supply chain attacks. Through all of it, one thing has stayed frustratingly constant: the security tools that are supposed to protect you are bad at their job. The Day My Site Got Hacked (While "Protected") There was one specific client cleanup that made me start building Nova Scan. It was a small business site, nothing fancy, running the paid version of Wordfence. The dashboard was a symphony of reassurance, with green checkmarks everywhere, "firewall optimized," and "scan complete: no issues found." The site was also completely owned, with three backdoors running at the same time while the most popular security plugin in the WordPress ecosystem was showing everything clear. What Wordfence Missed Here is what I found when I actually looked at the files. Backdoor #1: The Impersonator A file called wp-content/db.php . WordPress legitimately supports drop-in database files at that path, so Wordfence looked at it and decided everything was normal. It wasn't. Inside was a single line using PHP's zip:// stream wrapper to pull executable code out of a hidden zip file. The file contained none of the strings signature scanners look for. It was using a legal PHP function to do something clearly illegal, and that single line was all the attacker needed. Backdoor #2: The Nesting Doll Six directories deep: .private/mu-plugins/widgets/twentytwentyfive/Renderer/index.php . That path was specifically crafted to look like a WordPress theme component, but what it actually contained was a full PHP file manager with a hardcoded password, giving the attacker a browser-based GUI to browse, upload, download, and modify any file on the entire server . It amounted to full FTP access through a web browser. Backdoor #3: The Fake Core File A file called wp-check.php sitting in the site root. At first glance it looks like a WordPress core file because the project ships things like wp-cron.php , wp-login.php , and wp-mail.php . But wp-check.php has never existed in any version of WordPress, and this one was a dropper stub planted the same day as the other two, whose only job was downloading and installing whatever payload the attacker wanted to run next. Wordfence didn't flag a single one of them. The Moment I Decided to Build Nova Scan I sat there staring at the Wordfence dashboard giving me an all-green, all-clear "your site is protected" while three backdoors were actively running. The thought that kept circling in my head: A green-light dashboard with three backdoors behind it is a bedtime story people tell themselves so they don't have to check under the bed. I've cleaned dozens of hacked sites over 25 years, and every single one of them was running a security plugin with a clean bill of health while the site was actively compromised. At some point you either keep cleaning up other people's messes forever, or you start building the tool you wish existed. I picked the second option. Why Free? Actually Free? The part of the WordPress security industry that kills me is how thoroughly it has turned fear into a subscription model . "We found 7 critical threats on your site. Upgrade to Premium to see the details." Read that again. They found threats, on your site, and they're hiding the details behind a paywall . That is a hostage situation dressed up as a security product. Your house is on fire and the fire department wants your credit card number before they will tell you which room to avoid. Nova Scan is free forever and stays free. There is no time-limited trial, no hidden premium tier for the real findings, and no "free for 3 scans then $99 a year" bait-and-switch. You get the full detail on every CVE, every suspicious file, and every recommendation, with no upsell nags in the scan results. If your site is hacked you deserve to know exactly how, without having to type in a credit card first. What Makes Nova Scan Different I built Nova Scan because every existing option was missing whatever I was looking for at 2 AM while cleaning up someone else's mess. It Actually Reads the Code Most scanners match filenames and known signatures, which is why they miss things like the db.php backdoor above, because the filename is "safe." Nova Scan doesn't care what a file is called. It reads the code inside, analyzes the behavior, and decides whether the file is malicious based on what it does rather than what it happens to be named. Machine Learning That Earns Its Keep I built a machine learning engine trained on real-world malware samples, backdoors, and skimmers, which scores every file based on behavioral patterns and catches obfuscated code, zero-day variants, and novel attack patterns that signature-based scanners have never seen. The detection intelligence is encrypted at rest, so attackers cannot read our playbook even if they get file access to your site. Database Scanning That Understands Context Your database can be just as compromised as your filesystem, whether through injected JavaScript in post content, rogue admin accounts, or malicious cron jobs. Nova Scan checks all of it, and it is smart enough to know the difference between a page builder storing in a post field and an attacker injecting . 27,000+ CVEs, No API Key Required Every plugin and theme on your site gets checked against the Wordfence Intelligence CVE database and the WPScan Vulnerability Database, with known vulnerabilities flagged instantly. There is no premium API key required for the core feed. False Positives? We Obsess Over Them Nothing destroys trust in a scanner faster than crying wolf. We recently ran Nova Scan on an 83,000-file client site and got 500 findings, every single one of them a false positive. Instead of shrugging, we spent days making the detection logic smarter, and that site now shows zero false positives at medium severity or above. Every rule still runs and nothing gets skipped. The scanner got accurate enough to tell the difference between a real threat and a plugin's translation file. What We Just Shipped (The Nerdy Stuff) Here is what went live this week: Vault-encrypted detection intelligence: all signatures, patterns, and rules are encrypted on disk, so if someone gets file access to your site they cannot reverse-engineer the detection logic. 36 YARA threat-hunting rules: integrated from the PHP Malware Finder and Elastic security research, catching obfuscation patterns, known webshell families, and packer signatures. VirusTotal integration: check suspicious file hashes against 70+ antivirus engines with one click. LLM prompt injection detection: in 2026 some attackers are embedding AI prompt injections inside PHP files. We detect 9 different patterns of it. Auto-vPatch CVE rules: the firewall now auto-generates WAF rules from CVE data, so when a new vulnerability gets disclosed, protection can be active before the plugin author even wakes up. Memory and OPcache integrity scanning: because some attacks live entirely in memory and never touch the filesystem. The Philosophy I believe three things about WordPress security: Security shouldn't cost $99 a year. If a scanner exists to protect people, it should protect all people, not just the ones with budget. You should never need a "premium license" to see what's wrong with your own website. That business model is ethically bankrupt. A scanner that shows you a clean report while three backdoors are running is worse than no scanner at all, because it gives you false confidence and makes you stop looking. Nova Scan exists because the alternatives failed me and my clients, and based on the sites I keep getting called in to clean, they are failing you too. Try It Nova Scan is free forever. Create an account, install the plugin, run a scan. If it finds something Wordfence missed, I won't say I told you so, although I might think it a little. Get Nova Scan → Nova Scan is still in early access, maintained by a solo dev, with bugs getting fixed at midnight, but it catches things the big names don't, and that is why it exists. ~ SephX, founder of Nova Heaven. 25 years of WordPress and zero tolerance for paid fear. --- # The Codex (Documentation) ## Nova Shield: Frontend Protection Setup URL: https://novaheaven.io/en/codex/nova-shield-frontend-protection-setup Last updated: 2026-04-07 Nova Shield is the frontend security layer for Nova Scan. It runs as a tiny JavaScript agent on your site, watching for DOM tampering, malicious script injection, and unauthorized form hijacking in real time. What Nova Shield Protects Against 🪞 DOM injection : malicious scripts added after page load 📝 Form hijacking : credit card / login form skimmers 🔗 Link tampering : redirect chain swaps 🧬 Script integrity drift : modifications to your JS files 🎭 Iframe injection : hidden ad/tracking frames 🛰️ Suspicious outbound calls : data exfiltration attempts Quick Setup (3 steps) 1. Enable Shield Nova Core → Nova Scan → Shield → Enable Frontend Protection 2. Pick a Mode Learning Mode (recommended for first 7 days): Shield watches and logs everything but blocks nothing. Use this to baseline your site. Active Mode : Shield blocks anything that doesn't match the learned baseline. 3. Verify the Agent Loaded Open your homepage in an incognito window, open DevTools → Console, and look for: Nova Shield] Active - monitoring 9 surfaces If you see that, you're done. If not, see Troubleshooting below. Configuration Options Setting Default What it does Mode Learning Learning vs Active Protected Pages All Restrict to checkout/login only if needed Form Protection On Watches all
elements for tampering Link Integrity On Hashes outbound links and re-checks on click Script Hashing On Locks first-party JS to known-good hashes Report Only Off Sends alerts but never blocks (even in Active mode) Whitelist Domains empty Domains Shield should ignore (e.g. googletagmanager.com ) Troubleshooting ❌ Shield agent not loading Check: Is Nova Scan active? Shield requires Nova Scan + Nova Core both running. Is your site behind a caching layer? Purge all 3 caches : Cloudflare, Hyper Nova, OPcache. Open view-source: on your homepage and search for nova-shield . If missing, the agent script wasn't injected, check that Shield is enabled under Nova Scan settings. ❌ CORS errors in browser console Shield reports back to your own site's REST endpoint, so CORS is rare, but it can happen if your site has aggressive CORS headers or runs the frontend on a different domain than the WordPress backend (headless WP setups). Fix: Go to Nova Core → Settings → Auth & CORS Add your frontend domain (e.g. https://example.com ) to Allowed Origins Save and purge caches If you see this in console: Access to fetch at 'https://yoursite.com/wp-json/nova/v1/shield/report' from origin 'https://yoursite.com' has been blocked by CORS policy …it usually means a security plugin (Wordfence, iThemes, etc.) is stripping the Access-Control-Allow-Origin header. Whitelist the /wp-json/nova/v1/shield/* route in that plugin. ❌ Cloudflare blocking Shield reports Cloudflare's bot management or WAF can flag Shield's POST reports as bot traffic. Symptoms: Console shows 403 or 1010 errors when Shield tries to report Shield Activity dashboard stays empty even though the agent is loaded Fix: Cloudflare Dashboard → Security → WAF → Custom Rules Create a rule: (http.request.uri.path contains "/wp-json/nova/v1/shield") Action: Skip → All remaining custom rules + Bot Fight Mode Also exclude the path from Cloudflare → Caching → Cache Rules so reports aren't cached. If you use Cloudflare Bot Fight Mode , add /wp-json/nova/v1/shield/* to the bot exclusions. Purge Cloudflare cache. ❌ Too many false positives in Active Mode You activated too early. Switch back to Learning Mode for another 7 days, then re-enable Active Mode. Shield needs to see all your site's normal patterns (Google Analytics, Tag Manager, third-party widgets, etc.) before it can tell what's anomalous. ❌ Tag Manager / Analytics getting blocked Add the third-party domain to Whitelist Domains : googletagmanager.com google-analytics.com connect.facebook.net cdn.cookielaw.org (OneTrust) Any other trusted analytics/marketing tools ❌ Forms breaking on checkout pages WooCommerce / EDD checkout forms use dynamic field generation that can trip Shield. Fix: Nova Scan → Shield → Protected Pages Exclude /checkout/ and /cart/ if you're on Active Mode and seeing breakage Or switch those pages to Report Only mode ❌ Shield Activity dashboard empty Check in this order: Is the agent loaded? ( view-source: your homepage, search for nova-shield ) Are reports reaching the server? (DevTools → Network → filter for shield/report ) Is Cloudflare/WAF blocking the reports? (see Cloudflare section above) Purge OPcache: sometimes the report endpoint is stale Best Practices Always start in Learning Mode for 7 days minimum. Skipping this guarantees false positives. Whitelist your analytics/marketing stack before going Active. Run Nova Scan + Shield together - Scan catches what's already there, Shield catches what tries to get in. Check Shield Activity weekly during the first month to tune your whitelist. Use Report Only mode on critical pages (checkout, login) for the first 2 weeks of Active Mode - you get alerts without breaking customers. Common Question Q: Does Shield slow down my site? A: The agent is ~9KB gzipped and runs after page load. Real-world impact is under 5ms on first paint. Q: Does Shield work with HyperNova caching? A: Yes. Shield's agent is injected at render time and the report endpoint bypasses cache automatically. Q: Will Shield see my visitors' personal data? A: No. Shield only hashes structural patterns (DOM shape, script hashes, form field counts). It never reads field values or sends content off-site. Q: Can I run Shield without Nova Scan? A: No. Shield is a feature of Nova Scan and requires it active. --- ## Troubleshooting Common Issues URL: https://novaheaven.io/en/codex/troubleshooting Last updated: 2026-04-02 Solutions to the most common issues you might encounter when setting up and using Nova plugins. License Activation Fails "License verification failed" Check your key:  Make sure you copied the full key including the prefix, with no extra spaces Activate your site first:  On novaheaven.io, Divine Keys, make sure you added your site URL to the product before trying to activate in WordPress URL mismatch:  The URL you activated on novaheaven.io must exactly match your WordPress site URL (including https:// and www if applicable). Check Settings → General in WordPress. Outbound requests blocked:  Some hosts block outbound HTTPS requests from WordPress. Ask your host to whitelist lic.novaheaven.io "Nova Core is required" Every Nova plugin needs Nova Core active. Install and activate Nova Core before activating any other Nova plugin. Scan Issues Scan stops or times out PHP time limit:  Deep scans on large sites may exceed your server time limit. Try a Quick or Standard scan first, or ask your host to increase the PHP time limit to 300 seconds. Memory limit: The N-Dimensional Engine requires adequate memory. A minimum of 128MB is recommended; 256MB is ideal. Check your php.ini or ask your host. NDE shows "Inactive" The NDE needs to initialize on first run. This happens automatically when Nova Core verifies your license. If the engine stays inactive: Go to Nova Core → Divine Keys and click Refresh Wait 60 seconds, then reload the Nova Scan dashboard If still inactive, check that your license is active and your site is activated for Nova Scan Performance Issues Admin pages load slowly Large result sets:  If you have thousands of scan results, the Results tab may take a moment to load. This is normal for the first load. Object cache:  If you have Redis or Memcached available, enable object caching in Hyper Nova for faster admin page loads. Update Issues "Download failed" when updating Ensure Nova Core is active and your license is verified Check that your server can reach dist.novaheaven.io over HTTPS Try clicking Refresh on the Divine Keys page, then retry the update Still Need Help? If none of the above solutions resolve your issue: Check the FAQ for additional answers Contact us with your site URL, Nova Core version, and a description of the issue --- ## Understanding Your License URL: https://novaheaven.io/en/codex/understanding-your-license Last updated: 2026-04-02 Nova Heaven uses a single license key for your entire plugin suite. One key, all plugins, all sites. How Licensing Works When you register on novaheaven.io, you receive a single license key. This key governs access to every Nova plugin. Your plan determines which products you can use and how many sites you can activate. Plans and Tiers Paid plans have tiers that control your site limit: Tier Sites Alpha 1 site Trinity 3 sites Seraph 6 sites Divine 9 sites Omega Unlimited Nova Scan Is Always Free Every Nova Heaven account includes a free Nova Scan license. No credit card required. The free plan includes the full NDE-powered scanner and community threat feed with no site limit . Free licenses are valid for 90 days at a time and can be renewed indefinitely at no cost. Site Activation Before a plugin works on a site, you need to activate that site for the specific product: Go to your Divine Keys tab on novaheaven.io Find the product card (e.g. Nova Scan) Enter your site URL and click Add Each site URL counts as one activation. On paid tiers, your total activations are capped by your tier limit. On the free Nova Scan plan, there is no cap. Plugin-Side Verification After entering your license key in Nova Core on your WordPress site, verification happens automatically: Nova Core contacts the license server over encrypted HTTPS Your key, site URL, and installed products are verified The result is cached locally so your site works even if the license server is temporarily unreachable Cache refreshes automatically for active licenses Free License Renewal Free licenses are valid for 90 days at a time. When your free license is within 7 days of expiring, a renewal button appears on your Divine Keys page. Click it to renew for another 90 days. Instant, no payment required. You can renew forever. Moving to a New Server If you migrate your WordPress site to a new host, Nova Core will automatically detect the server change on the next verification cycle. Your license stays valid. --- ## Firewall and Protections URL: https://novaheaven.io/en/codex/firewall-and-protections Last updated: 2026-04-02 Nova Scan includes a built-in Web Application Firewall (WAF) and multiple protection layers that block threats before they reach your site. The Protections Tab The Protections tab in Nova Scan is your control center for all active defense features. Each protection can be toggled independently. Web Application Firewall (WAF) The WAF inspects incoming HTTP requests in real time using the N-Dimensional Engine. It blocks: SQL injection:  Malicious database queries in URL parameters, form data, and cookies Cross-site scripting (XSS):  Script injection attempts in request payloads Path traversal: Attempts to access files outside the web root Remote code execution: Payloads designed to execute commands on your server File inclusion attacks: Attempts to load malicious remote or local files Brute Force Protection Blocks repeated login attempts by tracking failed logins per IP address. After a configurable number of failures, the IP is temporarily locked out. This protects against automated password-guessing attacks. Request Filtering Filters suspicious request patterns including: Unusually long query strings Known malicious user agents Requests to sensitive WordPress files Null byte injection attempts The Firewall Tab The dedicated Firewall tab shows: Blocked requests: A live count of threats stopped Top attacking IPs:  Which addresses are targeting your site most Block rules:  Custom IP and country-based blocking rules Firewall log:  Recent blocked requests with full details Nova Shield Nova Shield is a cross-domain frontend security layer that protects your site visitors. It monitors your pages in the browser to detect: DOM injection:  Unauthorized scripts or elements added to your pages Script integrity violations: Modified or tampered JavaScript files Suspicious redirects:  Attempts to redirect your visitors to malicious sites Shield violations appear on the Shield tab in your Nova Scan dashboard with full details about what was detected and when. --- ## Scanning Your Site with Nova Scan URL: https://novaheaven.io/en/codex/scanning-your-site Last updated: 2026-04-02 Nova Scan detects malware, backdoors, and suspicious code across your entire WordPress installation. This guide covers scan profiles, understanding results, and taking action on threats. Scan Profiles Nova Scan offers three scan profiles, each covering a different scope: Quick Scan Checks your plugins , themes , and uploads directories. This is the fastest option and catches the most common attack vectors, injected plugin files, backdoor themes, and suspicious uploads. Standard Scan Covers the entire wp-content directory including mu-plugins, drop-ins, and any custom directories. Recommended for routine scanning. Deep Scan Scans your complete WordPress installation from the root directory down. This catches threats hidden in core files, wp-admin modifications, and root-level backdoors. Takes the longest but leaves nothing unchecked. The N-Dimensional Engine At the heart of Nova Scan is the NDE, a proprietary N-Dimensional detection engine that analyzes code at a level traditional scanners cannot reach. Unlike conventional security plugins that rely on static virus definitions, the N-Dimensional Engine evaluates files across multiple dimensions simultaneously. It detects both known threats and zero-day attacks that have never been catalogued without needing constant definition updates. The engine runs specialized analysis for PHP files, JavaScript files, database content, and firewall requests - each tuned for its own threat landscape. Understanding Results After a scan completes, the Results tab shows every finding with: Severity level:  Critical (red), High (orange), Medium (yellow), or Low (blue) NDE Confidence: A percentage showing how certain the engine is. Higher means more confident the file is malicious. File path:  The exact location of the suspicious file Detection method:  Whether it was caught by NDE analysis, pattern match, or both Taking Action For each finding, you can: Quarantine: Moves the file to a safe, non-executable location. The file is preserved so you can restore it if needed. This is the safest first step. Delete:  Permanently removes the file. Use this when you are certain the file is malicious. Mark as Clean:  Tells Nova Scan this file is safe. It will not be flagged in future scans. Your vote also contributes to the community clean hash network, helping other Nova Scan users. The Compare Tab The Compare tab lets you diff any scanned file against its original version from the WordPress.org repository. This is invaluable for detecting injected code in core files, plugins, and themes, you can see exactly what changed. Scheduled Scans In Settings , you can configure Nova Scan to run automatically: Choose daily, weekly, or custom intervals Select which scan profile to use Results appear in your dashboard on the next visit For most sites, a daily Standard Scan provides excellent protection with minimal server impact. --- ## Your First 7 Minutes with Nova Heaven URL: https://novaheaven.io/en/codex/getting-started Last updated: 2026-04-02 From zero to a fully protected WordPress site in under 7 minutes. This guide walks you through every step to creating your account, activating your license, installing the plugins, and running your first scan. Step 1: Create Your Free Account Visit novaheaven.io/dashboard Click the Register tab Enter your email , display name , and choose a password (minimum 8 characters) Click Create Account You will see a confirmation screen asking you to check your email. Step 2: Confirm Your Email Open the confirmation email from Nova Heaven (check spam if it does not arrive within a few minutes) Click the confirmation link, it takes you to a "Seal Verified" page You are automatically redirected to your dashboard What happened behind the scenes: A free Nova Scan license was created for you automatically. It is valid for 90 days and can be renewed for free, indefinitely. Just click the renew button on your Divine Keys page when it is close to expiring. There is no site limit on the free plan. Step 3: Find Your License Key In your dashboard, click the Divine Keys tab Your license key is displayed at the top Click the key to copy it to your clipboard, you will need it in the next step The Divine Keys page also shows your plan, how many sites you have activated, and which products are available to you. Step 4: Activate Your Site Before installing anything on WordPress, tell Nova Heaven which site you want to protect: On the Divine Keys page, find the Nova Scan product card Type your site URL in the input field (e.g. https://yoursite.com ) Click Add Your site now appears under the Nova Scan card with a green status. You can add as many sites as you need on the free plan. Step 5: Install Nova Core Nova Core is required. Every Nova plugin depends on it for licensing, updates, and shared features. Install it first. Download Nova Core from your Nova Heaven dashboard In your WordPress admin, go to Plugins → Add New → Upload Plugin Upload the Nova Core zip file Click Install Now , then Activate A new Nova Core menu appears in your WordPress sidebar Step 6: Enter Your License Key In WordPress admin, go to Nova Core → Divine Keys Paste your license key into the input field Click Activate You should see a success message and your license details will appear, plan name, days remaining, and which products are entitled. If you see an error, double-check that: The key was copied correctly (no extra spaces) You activated your site URL on the Divine Keys page in Step 4 Your site can make outbound HTTPS requests (some hosts block this) Step 7: Install Nova Scan Once Nova Core is active and your license is verified, installing Nova Scan is simple: Go to Nova Core → Overview in your WordPress admin In the plugin grid, find Nova Scan, it shows as "Not Installed" Click View Nova Scan to download it from novaheaven.io Upload the zip via Plugins → Add New → Upload Plugin and activate Nova Scan will automatically register with Nova Core and verify your license. If everything is green, you are ready to scan. After the initial install, all future updates are handled automatically through Nova Core, no more manual zip uploads. Your First Scan Go to Nova Core → Nova Scan You land on the Dashboard tab, this shows your site health overview Click the Scan tab Choose a scan profile: Quick Scan:  checks plugins, themes, and uploads (fastest) Standard Scan:  checks the full wp-content directory Deep Scan: checks your entire WordPress installation Click Start Scan Nova Scan is powered by the N-Dimensional Engine, a proprietary detection engine built to identify both known and zero-day threats without relying on a traditional virus definition database. Understanding Your Results After the scan completes, switch to the Results tab. Each finding shows: Severity: Critical, High, Medium, or Low Confidence:  how certain the NDE is (0 to 100%) File path: where the suspicious file lives Detection type:  NDE detection, pattern match, or both From here you can quarantine suspicious files (moves them to a safe location), delete confirmed threats, or mark as clean if you trust the file. What Next? Enable the Firewall:  Go to the Protections tab to activate WAF protection, brute-force blocking, and request filtering Set Up Scheduled Scans:  In Settings, configure automatic daily or weekly scans Explore the Dashboard: The main dashboard shows threat trends over time, scan history, and your overall site health score Try Hyper Nova:  If you want performance optimization alongside security, upgrade your plan to add Hyper Nova caching Need help? Visit the FAQ or contact us . --- ## Hyper Nova: Caching and Performance URL: https://novaheaven.io/en/codex/hyper-nova-caching Last updated: 2026-04-01 Hyper Nova is a high-performance caching engine for WordPress. It serves cached pages in microseconds, reduces server load, and works alongside Nova Scan to keep your site both fast and secure. Installation Hyper Nova requires Nova Core (like all Nova plugins). If you already have Nova Core installed and your license activated: Download hyper-nova.zip from your Nova Heaven dashboard Plugins → Add New → Upload Plugin → upload and activate Hyper Nova appears under the Nova Core menu How It Works Hyper Nova creates static HTML snapshots of your pages and serves them directly, bypassing PHP and database queries entirely. When a visitor requests a page: Hyper Nova checks if a fresh cached copy exists If yes: serves it instantly (no PHP execution, no database queries) If no: lets WordPress generate the page normally, then caches the result for next time The Dashboard Hyper Nova's dashboard shows real-time performance metrics: Cache hit rate:  Percentage of requests served from cache Response time:  Average page load time Pages cached:  Total number of cached pages Cache size: Disk space used by the cache Cache Management Purge All:  Clears the entire cache. Use after major site changes. Purge URL:  Clear cache for a specific page Auto-purge:  When you update a post or page, Hyper Nova automatically clears the cached version Configuration Key settings in the Settings tab: Cache lifetime:  How long pages stay cached before regenerating Exclusions:  URLs or patterns to never cache (e.g. cart, checkout, account pages) Mobile caching:  Separate cache for mobile devices if your theme serves different markup Logged-in users:  Whether to serve cached pages to logged-in users Redis Object Cache If your host provides Redis, Hyper Nova can use it as an object cache backend. This speeds up database queries for dynamic pages that cannot be fully cached (admin pages, WooCommerce carts, etc.). Enable Redis in Settings → Object Cache and enter your Redis connection details. --- ## Nova Core: The Foundation URL: https://novaheaven.io/en/codex/nova-core-foundation Last updated: 2026-04-01 Nova Core is the shared foundation that powers every Nova plugin. It handles licensing, plugin updates, shared UI, and cross-plugin communication. Why Nova Core Is Required Every Nova plugin requires Nova Core to function. Without it, plugins cannot verify licenses, receive updates, or access shared features. If Nova Core is deactivated, all dependent plugins will show a notice and disable their features until it is reactivated. What Nova Core Provides License management:  Enter one key, activate all your plugins Automatic updates:  Secure, signed plugin updates delivered directly from Nova Heaven Shared admin framework:  Consistent dark-themed UI across all Nova plugins Nova Pulse:  Security bulletins, release announcements, and system broadcasts Installation Download nova-core.zip from your Nova Heaven dashboard In WordPress admin: Plugins → Add New → Upload Plugin Upload the zip, click Install Now , then Activate After activation, you will see the Nova Core menu in your WordPress sidebar with the starburst icon. The Dashboard Nova Core's dashboard shows: Installed plugins:  A grid of all detected Nova plugins and their status License summary: Your current plan, tier, and days remaining Nova Pulse feed:  Latest broadcasts from the Nova Heaven team Divine Keys Page This is where you manage your license on the WordPress side: Enter or change your license key View plan details, site count, and expiration See which products are activated on this site Activate or deactivate individual products Force-refresh your license verification Plugin Updates Nova Core handles updates for all Nova plugins through a secure pipeline: Update checks happen automatically every 6 hours When an update is available, it appears in the standard WordPress updates screen Downloads use one-time signed URLs that expire in 15 minutes Each download URL can only be used once You can also check for updates manually from the Nova Core dashboard. ---