Updated: October 3, 2026
Security: the evidence
Saying “it’s secure” is easy. Here are results from independent scanners that anyone can repeat, what the client system protects and how we verify it.
Results from independent scanners
We checked this website with three public scanners on October 3, 2026. Tap each link to run the test again right now: the result comes from the scanner, not from us.
- A+Mozilla HTTP Observatory130/100 · 12 of 12 tests passedCheck on Mozilla →
- A+SecurityHeaders.comSecurity headersCheck on SecurityHeaders →
- A+Qualys SSL LabsHTTPS configurationCheck on SSL Labs →
Préstamos Clover and Spanish with Emi, two websites we built with the same system, got the same grades on the same day.
What about your site? Check it for free with Mozilla HTTP Observatory (in Spanish) →
What the client system protects
The OWASP Top 10 is the list of the most common risks in web applications. This is how the system we install (panel, Client area and forms) covers each one:
Access control
Every action is authorized on the server according to the person’s permissions; each client sees only their own data (with automated tests that try to read another client’s data); sessions can be closed from the server.
Cryptography
Mandatory HTTPS with HSTS; passwords stored as hashes with Argon2id or bcrypt; the two-step verification key is stored encrypted; activation codes are stored as hashes.
Injection (SQL and XSS)
Every database query uses prepared statements; everything displayed is escaped; a content security policy (CSP) with a nonce or hash only lets the site’s own scripts run, with no injected inline scripts or onclick attributes.
Secure design
CSRF tokens on every form and origin checks (Origin and Sec-Fetch-Site); single-use codes that expire; for sensitive actions the password is asked again (deleting clients, downloading backups) and, to manage users, the two-step code too.
Configuration
Only allowed files can run; data lives outside the site’s public folder; complete security headers; errors are never shown to visitors; the site build stops if it finds anything unsafe.
Components
No third-party frameworks or plugins on the server; the two libraries the panel uses (charts and QR code) are loaded with integrity verification (SRI).
Identification and authentication
Mandatory two-step verification for the team; login attempt limits per IP and per account; the same response whether or not the user exists; secure __Host- cookies, strict-mode sessions that expire after 30 minutes of inactivity or after 12 hours.
Data and file integrity
Uploaded files are validated by their real content, stored with a random name outside the website and delivered so they cannot run; design proposals open isolated (sandbox), with no access to the Client area session.
Logging and monitoring
Security log of logins, failed attempts, denied access and changes; warnings in the panel if a backup is missing or an administrator has not enabled two-step verification.
Server-side requests (SSRF)
The system never downloads addresses sent by a user.
Also: automatic backups on every day the panel is used, our own statistics with no cookies and no stored IPs, and a security.txt file for reporting problems.
How we verify it
- More than 400 automated tests on every change: attack attempts (injection, XSS, CSRF, session theft, access to another client’s data, malicious files, brute force) and the built site served with its real configuration.
- Two independent security reviews before publishing, by reviewers who tried to break the system.
- Live checks after every publication: HTTPS, headers, files that must never be visible, and the panel.
No system is invulnerable: that is why we measure, review and publish the results so you can check them.
Found a problem?
If you find a security flaw, please tell us responsibly before publishing it: the contact details are in /.well-known/security.txt, or write to info@paginasclover.com. We will reply and fix it as soon as possible.
What the system stores and for how long is in the Privacy policy.