ARACNE Security

ARACNE analyses the exposure of your WordPress site and applies basic hardening measures. Everything runs on your own server.

• Exposure scanner — checks for publicly accessible sensitive files (.env, .git, wp-config backups, debug.log), XML-RPC, user enumeration, visible version, security headers, directory listing, readme.html, the file editor, the "admin" user, the table prefix, the PHP and WordPress versions, plugins and themes with pending updates and WP_DEBUG. It also reports common signs of intrusion: administrators hidden from the Users screen, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress.
• Security score — a rating from 0 to 100 with an explanation of each risk.
• Basic hardening — blocks user enumeration, hides the WordPress version, blocks readme.html/license.txt, removes X-Powered-By, hides the REST index, makes login errors generic, disables the file editor, and optionally disables XML-RPC and Application Passwords.

ARACNE Pro ARACNE Pro is a paid add-on, distributed by Cerwall from aracne.cerwall.com, that adds a WAF, protection profiles, progressive IP blocking, a bot filter, IP lists, security headers and CSP, .htaccess management, integrations with site management platforms, reports and alerts. This free version works without the add-on and has no time limit. External services The scanner only sends HTTP requests to your own site. This plugin can connect to the ARACNE service at https://aracne.cerwall.com, operated by Cerwall Solutions S.L., to register the installation. The connection is disabled by default and is only made after an administrator enables the installation notice in ARACNE → Ajustes. From then on the site sends, when the option is enabled and then once a day: the installation ID, the site URL, the administrator email, the WordPress version and the plugin version. Disabling the option stops the requests.

• Service: https://aracne.cerwall.com
• Privacy policy: https://cerwall.com/terms
• Legal notice and terms of use: https://cerwall.com/aviso

1.1.9

• The scanner reports each plugin and theme with a pending update; being a major version behind counts as high risk.
• A risk the scanner observes stays reported even when the matching hardening option is enabled, for example readme.html on servers that ignore .htaccess.

1.1.8

• The readme describes the plugin screenshots.

1.1.7

• The scanner reports signs of intrusion: hidden administrators, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress.

1.1.6

• The setup wizard names the button that finishes it as it appears on screen.

1.1.5

• The main plugin file is named after the plugin slug: aracne-security.php.
• The scanner styles and notices are loaded with wp_enqueue_style() and wp_add_inline_script() instead of inline tags.
• The .htaccess block is removed through the WordPress Filesystem API, without error suppression.
• The External services section links to the service, its privacy policy and its legal notice.

1.1.4

• The admin screens use the Open Sans font bundled with the plugin (SIL Open Font License 1.1) and no longer load fonts from external servers.
• The REST API users check builds its URL with rest_url(), so it works with custom REST prefixes.
• The Contributors field lists the plugin owner's WordPress.org username.

1.1.3

• Coding standards: the WordPress core constant DISALLOW_FILE_EDIT is documented as an allowed exception to the plugin prefix rule.
• The installation instructions name the aracne-security folder.

1.1.2

• The text domain matches the WordPress.org slug, aracne-security; translations are loaded from WordPress.org.

1.1.1

• The help and ARACNE Pro links point to cerwall.com.
• Request data is unslashed and sanitized before use, and the admin views escape all output.
• Tested with WordPress 7.1.

1.1.0

• User enumeration blocking also covers the WordPress users sitemap.
• The scanner verifies the certificate in requests to the site itself, and its token is only valid for the URL it checks.
• Deleting the plugin removes its settings, temporary data, scheduled tasks and its .htaccess block.

1.0.0

• Initial release: exposure scanner, security score and basic WordPress hardening.
• Optional installation notice, disabled by default.