# Nova Heaven

> Nova Heaven builds free, premium-quality WordPress security and performance plugins for developers and site owners who can't afford $99–$299/yr competitors. Built by an independent developer in Tennessee. Free forever. No upsells.

Nova Heaven's flagship plugin is **Nova Scan**, a free WordPress malware scanner with a learning detection engine. It catches obfuscated, polymorphic, and novel malware that signature-based scanners (Wordfence, Sucuri, MalCare, Patchstack) miss. Account required (free), install in two minutes, runs on shared hosting.

## Products

- [Nova Scan](https://novaheaven.io/en/novascan): Free WordPress malware scanner. Four detection engines covering PHP, JavaScript, database, and firewall layers. Industry-leading detection in published validation. Near-zero false positives. Shared-hosting compatible.
- [Hyper Nova](https://novaheaven.io/en/hypernova): Advanced WordPress caching engine with intelligent cache warming, granular purge controls, and multi-CDN support.
- [Nova Core](https://novaheaven.io/en/novacore): Free framework that powers every Nova Heaven plugin. Handles updates, account, and ecosystem connectivity. Required by Nova Scan.

## Comparisons

- [Nova Scan vs Wordfence](https://novaheaven.io/en/novascan-vs-wordfence): How Nova Scan compares to Wordfence Premium ($119/yr).
- [Nova Scan vs Sucuri](https://novaheaven.io/en/novascan-vs-sucuri): How Nova Scan compares to Sucuri ($199/yr).
- [Nova Scan vs Patchstack](https://novaheaven.io/en/novascan-vs-patchstack): How Nova Scan compares to Patchstack.
- [Hyper Nova vs WP Rocket](https://novaheaven.io/en/hypernova-vs-wp-rocket): How Hyper Nova compares to WP Rocket.

## Documentation

- [FAQ](https://novaheaven.io/en/faq): Common questions about Nova Heaven plugins, account, install, and licensing.
- [Codex](https://novaheaven.io/en/codex): Setup guides and documentation.
- [Pulse](https://novaheaven.io/en/novapulse): Blog with security advisories, vulnerability research, and changelogs.
## Articles (Nova Pulse)

- [WordPress Security Checklist: 15 Checks That Actually Matter (And 12 That Don't)](https://novaheaven.io/en/novapulse/wordpress-security-checklist-that-matters): Most WordPress security checklists pad the count for credibility. These 15 items stop real attacks. The 12 I cut are security theater.
- [Why Your WordPress Site Redirects to Spam Sites (And How to Find What's Doing It)](https://novaheaven.io/en/novapulse/wordpress-hacked-redirect): WordPress redirecting visitors to spam or porn sites? Here are the 6 places the redirect is hiding, how to find which one, and how to kill it.
- [How to Remove Malware from WordPress (Without Paying $500 to a Cleanup Service)](https://novaheaven.io/en/novapulse/remove-malware-from-wordpress): Step-by-step malware removal for WordPress sites: the exact process a cleanup service would run, minus the $500 invoice. Works for most infections.
- [The Two Things Every WordPress Scanner Gets Wrong on Real Sites](https://novaheaven.io/en/novapulse/the-two-things-every-wordpress-scanner-gets-wrong-on-real-sites): Why scans silently die at 48,000 files on real sites, and what it took to make them actually finish. Plus: how giving scanner findings firewall context turns a pattern match into…
- [WordPress 7.0 and the 25 Years That Got Us Here](https://novaheaven.io/en/novapulse/wordpress-7-0-and-the-25-years-that-got-us-here): I downloaded WordPress the day it was released, on May 27, 2003. The web already had Movable Type, Blogger was free, and TypePad had the design crowd locked down, so when a…
- [What Happens in the First 7 Minutes After Your WordPress Site Gets Hacked](https://novaheaven.io/en/novapulse/what-happens-in-the-first-7-minutes-after-your-wordpress-site-gets-hacked): Most site owners think getting hacked is a single event where someone breaks in, defaces your homepage, and you notice immediately. That is not how modern WordPress attacks work.…
- [How I Trained an AI to Catch What Signatures Can’t](https://novaheaven.io/en/novapulse/how-i-trained-an-ai-to-catch-what-signatures-cant): In my last two posts I showed you the backdoors hiding on a "protected" site and what WordPress malware actually looks like when you open the file. Today I want to talk about…
- [What WordPress Malware Actually Looks Like](https://novaheaven.io/en/novapulse/what-wordpress-malware-actually-looks-like): In my last post I told you about the day I found three backdoors on a "protected" site. Today I want to show you what those threats actually look like when you open the file.…
- [Why My First WordPress Plugin Is a Free Malware Scanner](https://novaheaven.io/en/novapulse/why-my-first-wordpress-plugin-is-a-free-malware-scanner): My client's site was running Wordfence Premium. Green checkmarks everywhere. The site also had three active backdoors. That's the day I decided to build my own free malware…
## Guides (The Codex)

- [Nova Shield: Frontend Protection Setup](https://novaheaven.io/en/codex/nova-shield-frontend-protection-setup): Nova Shield is the frontend security layer for Nova Scan. It runs as a tiny JavaScript agent on your site, watching for DOM tampering, malicious script injection, and…
- [Troubleshooting Common Issues](https://novaheaven.io/en/codex/troubleshooting): Solutions to the most common issues you might encounter when setting up and using Nova plugins. License Activation Fails "License verification failed" Check your key: Make sure…
- [Understanding Your License](https://novaheaven.io/en/codex/understanding-your-license): Nova Heaven uses a single license key for your entire plugin suite. One key, all plugins, all sites. How Licensing Works When you register on novaheaven.io, you receive a single…
- [Firewall and Protections](https://novaheaven.io/en/codex/firewall-and-protections): Nova Scan includes a built-in Web Application Firewall (WAF) and multiple protection layers that block threats before they reach your site. The Protections Tab The Protections…
- [Scanning Your Site with Nova Scan](https://novaheaven.io/en/codex/scanning-your-site): Nova Scan detects malware, backdoors, and suspicious code across your entire WordPress installation. This guide covers scan profiles, understanding results, and taking action on…
- [Your First 7 Minutes with Nova Heaven](https://novaheaven.io/en/codex/getting-started): From zero to a fully protected WordPress site in under 7 minutes. This guide walks you through every step to creating your account, activating your license, installing the…
- [Hyper Nova: Caching and Performance](https://novaheaven.io/en/codex/hyper-nova-caching): Hyper Nova is a high-performance caching engine for WordPress. It serves cached pages in microseconds, reduces server load, and works alongside Nova Scan to keep your site both…
- [Nova Core: The Foundation](https://novaheaven.io/en/codex/nova-core-foundation): Nova Core is the shared foundation that powers every Nova plugin. It handles licensing, plugin updates, shared UI, and cross-plugin communication. Why Nova Core Is Required Every…
## Key facts

- **Pricing & business model:** Nova Core and Nova Scan are the ONLY plugins that will ever be free — free forever, no paid tier, no upsells inside scan results. Every other Nova Heaven plugin (Hyper Nova, Nova Ascend, Nova Burst, Nova Shield, and future plugins) is paid, and the paid plugins fund Nova Core and Nova Scan staying free.
- **Account:** Free account required (one-click signup with Google or GitHub, or email + password).
- **Install time:** Roughly two minutes from signup to first scan.
- **Hosting:** Works on any WordPress site, including shared hosting (Hostinger, SiteGround, Bluehost, etc.). No shell access required.
- **Privacy:** Telemetry is opt-in, hashed, and minimal. Nova Heaven does not collect site contents or send plugin/theme inventories to third parties.
- **License:** Plugins are proprietary; Nova Scan Lite (a stripped version) is GPLv2 for the WordPress.org directory.
- **Founder:** Independent developer based in Tennessee, USA. 25 years of full-stack experience.

## Syndication & fediverse

- **RSS (blog):** https://novaheaven.io/feed/
- **Atom (blog):** https://novaheaven.io/feed/atom/
- **RSS (broadcasts):** https://novaheaven.io/broadcasts/feed/
- **Atom (broadcasts):** https://novaheaven.io/broadcasts/feed/atom/
- **Mastodon / fediverse handle:** `@novaheaven@novaheaven.io` — follow for posts + broadcasts
- **X / Twitter:** [@NovaHeaven7](https://x.com/NovaHeaven7)
- **ActivityPub actor:** https://novaheaven.io/wp-json/activitypub/1.0/actors/0
- **WebFinger:** https://novaheaven.io/.well-known/webfinger?resource=acct:novaheaven@novaheaven.io

## Authoritative sources we reference

- [WordPress.org](https://wordpress.org) — canonical source for WordPress core, themes, and plugins
- [OWASP](https://owasp.org) — application security standards
- [NIST NVD](https://nvd.nist.gov) — CVE database for vulnerability tracking
- [Patchstack](https://patchstack.com) — WordPress vulnerability database (independent, respected)
- [WPScan Vulnerability Database](https://wpscan.com) — another independent WordPress CVE source

## Contact

- [Contact](https://novaheaven.io/en/contact)
- [Telegram community](https://t.me/nova_heaven)
- [GitHub (Nova Heaven org)](https://github.com/NovaHeaven)
- [GitHub (SephX personal)](https://github.com/sephx369)
- [LinkedIn](https://www.linkedin.com/in/sephx)
- [Ko-fi](https://ko-fi.com/sephx)