CloviScan detects code vulnerabilities, exposed files, server weaknesses, and security headers — and tells you exactly how to fix them. Lite: from $9/mo for 3 scans per month.
No sign-up required · results in ~60 seconds
One platform for your whole attack surface — site security, repository security, SEO, performance and accessibility. Point-solution code scanners only see your source. CloviScan also scans your full git history for secrets that were committed and later removed but are still recoverable.
/config.js — line 23
CRITICAL
/phpmyadmin
HIGH
Below is an actual scan report of a public test site — every finding is real, nothing is mocked up.
Sample scan of testphp.vulnweb.com — Acunetix's official intentionally-vulnerable public test site.
Other scanners check what's visible. CloviScan goes four layers deep — analysing your external footprint, your actual source code, your server configuration, and then showing you exactly how to fix everything it finds.
Your site's public-facing security profile, examined from the outside — exactly as a security researcher or attacker would see it. No access credentials required.
.env, wp-config.php, .git/configYour site may be leaking configuration files, credentials, and source code over public HTTP — without you knowing. CloviScan probes the paths attackers check first and surfaces anything that shouldn't be public.
.env files containing API keys, DB passwords, and secrets.git/config and .git/HEAD (full source code extraction risk)wp-config.php, config.php, /backup.zip common leaksEvery open port is a potential entry point. CloviScan probes 14 common ports from an external vantage point — exactly as an attacker scans a target — flagging anything that shouldn't be internet-facing.
Finding problems is the easy part. CloviScan goes further — every issue comes with a plain-English explanation, copy-paste code fix, and step-by-step server instructions so your team can resolve it today, not next sprint.
String interpolation in your database query lets an attacker pass SQL commands instead of an ID. This can expose your entire database with a single request.
db.query(
'SELECT * FROM users WHERE id = ?',
[req.params.id]
);
Every major breach starts as a small, overlooked code issue. Here's how a hardcoded API key becomes a catastrophic security event — and how CloviScan breaks the chain.
A developer hardcodes an API key directly in a config file. It looks harmless. The test suite passes. The code ships to production.
An automated bot scans GitHub repositories and public websites for exposed secrets around the clock. Within hours of your deploy, your API key is being actively tested on the dark web.
Attackers use your exposed key to spin up compute instances, exfiltrate your customer database, or send thousands of spam messages — all billed to your account.
CloviScan catches this at Step 1 — before the crawler ever runs.
Scan Your Code NowEvery scan runs the full check library across your site, code, and server — and returns a graded report in under a minute.
Enter any website to see a sample of what CloviScan finds. No account required.
CloviScan feeds its findings into the tools you already use — so security stays on the radar everywhere, not just in a quarterly audit report.
No credit card required to start. All plans include AI-powered remediation advice — not just a list of problems.
Honest, feature-by-feature — no asterisks. Code-first scanners go deep but assume a developer audience and enterprise budget. Basic free checkers test one thing and stop. CloviScan covers the whole site in plain English.
| Capability | CloviScan | Typical code-first scanners | Basic free checkers |
|---|---|---|---|
| 🔥 Dynamic detonation (runtime malware in isolated browser) | |||
| 🔥 DNS/Email deep audit (SPF, DMARC, DKIM, DNSSEC, CAA) | |||
| 🔥 Sucuri malware enrichment (free, every scan) | |||
| 🔥 Security + SEO + Performance + A11y (one scan) | |||
| SSL/TLS certificate + cipher audit | |||
| Security headers (7 headers incl. COOP) | 4-5 only | Basic | |
| Port surface scan (14 ports) | |||
| CVE fingerprinting | |||
| Google Safe Browsing check | Some | ||
| Clean PDF report (CloviPrint) | Basic PDF | ||
| Plain-English findings + AI fixes | Jargon-heavy | ||
| Starting price | Free scan · Paid from $19/mo | $69–$249/mo | Free (limited) |
Security is one layer of site health. CloviScan shares findings with sibling tools for performance, accessibility, SEO, and automation — one login, one dashboard.
No credit card. No installation. Paste your domain and get a full security report in under 60 seconds.
Lite from $19/mo · No installation · Results in 60 seconds