Secrover Hosting Live In 5 Minutes

Secrover hosting turns your repositories and domains into a security report site that rescans itself. Deploy Secrover 0.12.3 as a scheduled scanner with an nginx server publishing the reports behind Basic Auth, with volumes for results and clones, over HTTPS in minutes. Enter the repositories and domains you own, and read the reports in a browser whenever a rescan completes.

Deploy your Secrover

No terminal
No technical skills needed
No lock-in, cancel anytime

What is Secrover?

Secrover is a free and open-source tool that generates security audit reports without paywalls or proprietary SaaS. Upstream scans dependencies with osv-scanner, code with opengrep and domains for SSL, TLS, open ports and headers, then writes human-readable HTML reports. A self-hosted Secrover is an alternative to a proprietary security audit SaaS, licensed GPL-3.0, and it can rescan on a built-in cron schedule.

Upstream ships a report generator without a web server, so on xCloud the template adds an nginx report site. It is Secrover 0.12.3 with nginx, both pinned by digest, on the secrover_output and secrover_repos volumes, behind one Basic Auth login and served over HTTPS. Secrover has no accounts or web interface of its own, so access is a single shared login.

From Sign-Up to a Live Secrover In Just 3 Easy Steps

A scheduled audit setup needs a scanner, a cron schedule, a web server for the reports, a login, volumes, a domain and a certificate. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account and pick Secrover from the OneClick catalog. Choose your domain, then enter a project name, the https repositories to scan, a default branch and optional domains you own.
Step 02
We Deploy It For You
One click. We start secrover/secrover:0.12.3 and an nginx report server, both pinned by digest, mount secrover_output and secrover_repos, generate the report password and publish the site over HTTPS. The first scan starts with the container.
Step 03
Read Your First Report
Open the HTTPS URL and sign in as admin with the generated password. Until the first scan finishes you see a short no-report page; then read the dependencies, code and domains reports. A redeploy starts a new scan.

Scheduled Dependency Vulnerability Scanning: Secrover On Your Own Server

Secrover runs here as a scheduler and a static report site, with results on a volume you control.

Dependency Vulnerability Checks
Upstream checks your dependencies for known vulnerabilities across all languages supported by osv-scanner, reported on a dedicated page.
Static Code Checks
Static analysis with opengrep flags code issues in your repositories, with a separate code report for the findings.
Domain Audit
Checks SSL certificates, HTTP to HTTPS redirects, HSTS, TLS versions, open ports, security headers and hosting location for domains you list.
Daily Rescans
The container scans at start, then rescans on CRON_SCHEDULE, which defaults to every day at 00:00 UTC.
Password-Protected Reports
The report pages sit behind Basic Auth with a generated password. The scan log and every other path answer 404.
Private Repositories Optional
Add a GITHUB_TOKEN for read access to private repositories. Upstream stores it in each clone's git config on the repos volume.

Everything You Need To Run Your Security Reports 24/7

Managed hosting for Secrover, so the parts that keep it online are not your problem.

Secrover 0.12.3 deployed instantly
Images pinned by digest
Report password generated
Scan log not served
Free SSL certificate
Reports and clones on persistent volumes
Server backups and snapshots
30+ server locations
Unused balance refunded

What You Can Do With Secrover

Publish a security report for your team
Give colleagues one password-protected URL with the latest dependency, code and domain findings.
Watch dependencies for new vulnerabilities
Let the daily rescan flag newly reported issues in the repositories you list, instead of checking by hand.
Check your own domains regularly
Audit certificates, redirects, TLS versions and open ports on domains you own, on a schedule.
Share audit results with a client
Send a client the report site and password rather than exporting documents each week.

Secrover Screenshots

Secrover report overview page served from an xCloud install

Secrover code audit report listing static analysis findings

Secrover vs Alternatives

Proprietary security audit SaaS: As a self-hosted alternative to proprietary security audit SaaS, Secrover keeps scans, clones and reports on a server you control, under GPL-3.0.
Wazuh: Wazuh has its own OneClick page. In a Secrover vs Wazuh comparison, Wazuh is a security monitoring platform, while Secrover publishes scheduled audit reports for repositories and domains.
CrowdSec: CrowdSec has its own OneClick page. It is a security engine for blocking behaviour on your servers, a different job from Secrover's audit reports.
Dependency-Track: Dependency-Track has its own OneClick page. It is another way to track vulnerable dependencies, so compare how each one is fed and how it reports.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for Secrover hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

More headroom for many large repositories.

59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. Secrover is licensed under GPL-3.0.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy Secrover on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Publish Your Security Reports?

Secrover on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. Your repositories, your reports, your domain.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

What does Secrover scan?

Upstream scans dependencies for known vulnerabilities, code with static analysis, and domains for SSL, redirects, HSTS, TLS versions, open ports, security headers and hosting location. Only scan repositories and domains you own or may test.

How often does Secrover rescan?

It scans once when the container starts, then rescans on CRON_SCHEDULE, which defaults to every day at 00:00 UTC. Keep the schedule set, because without it the container scans once and exits. A redeploy also starts a new scan.

Can you self-host Secrover with Docker?

Yes. Secrover ships a Docker image, and this template is Secrover Docker hosting without the setup: the 0.12.3 scanner and an nginx report server pinned by digest, two volumes, a generated password and HTTPS on your own domain.

How much RAM does Secrover need?

The manifest floor is 512 MB of RAM, a single core and 5 GB of disk. Cloning many large repositories needs more disk, and the 6 GB plan leaves ample room for the scanner and other apps beside it.

Can Secrover scan private repositories?

Yes, with a GITHUB_TOKEN set in the Environment editor. Upstream adds it to every https clone URL and stores it in each cloned repository's git config on the repos volume, so keep that volume private.

Is the Secrover report site private?

Yes. The report pages sit behind Basic Auth with user admin and a generated password, and the scan log and every other path answer 404. The reports describe weaknesses of your targets, so keep the password private.

Is Secrover open source?

Yes. Secrover is GPL-3.0 software, so the scanner is free to use. Your cost is the Cloud VPS that runs it, which makes this a Secrover cloud of your own instead of a paid audit service.

Does the domain audit open ports on my server?

No. The audit makes outbound connections to the domains you list and probes common ports on them. No port is opened on this server. Use only domains you own or may test, since the probing is visible to them.

How do I back up Secrover?

A backup is optional. secrover_output holds the generated reports and log, and secrover_repos holds clones; the next scan rebuilds both. Keep your install settings and report password instead, and back up the volumes if you want old reports.

Backup and restore Docker apps

How do I upgrade Secrover?

The install stays on its pinned 0.12.3 image until you adopt a newer template version. Back up the volumes if you want to keep old reports, read the upstream release notes, then redeploy. Nothing upgrades automatically, and a redeploy starts a fresh scan with the current settings.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.