{"id":394800,"date":"2026-11-05T13:10:32","date_gmt":"2026-11-05T13:10:32","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/aracne-security\/"},"modified":"2026-11-05T13:22:55","modified_gmt":"2026-11-05T13:22:55","slug":"aracne-security","status":"publish","type":"plugin","link":"https:\/\/sr.wordpress.org\/plugins\/aracne-security\/","author":23595081,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.1.8","stable_tag":"1.1.8","tested":"7.1.4","requires":"5.6","requires_php":"7.4","requires_plugins":null,"header_name":"ARACNE Security","header_author":"Cerwall Solutions S.L.","header_description":"Esc\u00e1ner de exposici\u00f3n con puntuaci\u00f3n de seguridad y endurecimiento b\u00e1sico de WordPress. Admite el add-on ARACNE Pro.","assets_banners_color":"212d59","last_updated":"2026-11-05 13:22:55","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/cerwall.com\/productos\/aracne","header_author_uri":"https:\/\/cerwall.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":254,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.1.7":{"tag":"1.1.7","author":"jfernandezcerwall","date":"2026-11-05 13:10:16","revision":3786039},"1.1.8":{"tag":"1.1.8","author":"jfernandezcerwall","date":"2026-11-05 13:22:55","revision":3786080}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3786038,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3786038,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3786038,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3786038,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.1.7","1.1.8"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3786078,"resolution":"1","location":"assets","locale":"","width":1280,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3786078,"resolution":"2","location":"assets","locale":"","width":1280,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3786078,"resolution":"3","location":"assets","locale":"","width":1280,"height":900}},"screenshots":{"1":"Exposure scanner: security score from 0 to 100 and each risk found, with what it is, why it matters and how to fix it.","2":"Basic hardening settings and the optional installation notice, disabled by default.","3":"Checks that already pass, with a short explanation of each one."}},"plugin_section":[],"plugin_tags":[31093,6464,600,46130,6558],"plugin_category":[54],"plugin_contributors":[290882],"plugin_business_model":[],"class_list":["post-394800","plugin","type-plugin","status-publish","hentry","plugin_tags-hardening","plugin_tags-scanner","plugin_tags-security","plugin_tags-user-enumeration","plugin_tags-xml-rpc","plugin_category-security-and-spam-protection","plugin_contributors-jfernandezcerwall","plugin_committers-jfernandezcerwall"],"banners":{"banner":"https:\/\/ps.w.org\/aracne-security\/assets\/banner-772x250.png?rev=3786038","banner_2x":"https:\/\/ps.w.org\/aracne-security\/assets\/banner-1544x500.png?rev=3786038","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/aracne-security\/assets\/icon-128x128.png?rev=3786038","icon_2x":"https:\/\/ps.w.org\/aracne-security\/assets\/icon-256x256.png?rev=3786038","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/aracne-security\/assets\/screenshot-1.png?rev=3786078","caption":"Exposure scanner: security score from 0 to 100 and each risk found, with what it is, why it matters and how to fix it."},{"src":"https:\/\/ps.w.org\/aracne-security\/assets\/screenshot-2.png?rev=3786078","caption":"Basic hardening settings and the optional installation notice, disabled by default."},{"src":"https:\/\/ps.w.org\/aracne-security\/assets\/screenshot-3.png?rev=3786078","caption":"Checks that already pass, with a short explanation of each one."}],"raw_content":"<!--section=description-->\n<p>ARACNE analyses the exposure of your WordPress site and applies basic hardening measures.\nEverything runs on your own server.<\/p>\n\n<ul>\n<li><strong>Exposure scanner<\/strong> \u2014 checks for publicly accessible sensitive files (.env, .git, wp-config backups, debug.log), XML-RPC, user enumeration, visible version, security headers, directory listing, readme.html, the file editor, the \"admin\" user, the table prefix, the PHP and WordPress versions and WP_DEBUG. It also reports common signs of intrusion: administrators hidden from the Users screen, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress.<\/li>\n<li><strong>Security score<\/strong> \u2014 a rating from 0 to 100 with an explanation of each risk.<\/li>\n<li><strong>Basic hardening<\/strong> \u2014 blocks user enumeration, hides the WordPress version, blocks readme.html\/license.txt, removes X-Powered-By, hides the REST index, makes login errors generic, disables the file editor, and optionally disables XML-RPC and Application Passwords.<\/li>\n<\/ul>\n\n<h4>ARACNE Pro<\/h4>\n\n<p>ARACNE Pro is a paid add-on, distributed by Cerwall from aracne.cerwall.com, that adds a WAF,\nprotection profiles, progressive IP blocking, a bot filter, IP lists, security headers and CSP,\n.htaccess management, integrations with site management platforms, reports and alerts. This free\nversion works without the add-on and has no time limit.<\/p>\n\n<h4>External services<\/h4>\n\n<p>The scanner only sends HTTP requests to your own site.<\/p>\n\n<p>This plugin can connect to the ARACNE service at https:\/\/aracne.cerwall.com, operated by Cerwall\nSolutions S.L., to register the installation. The connection is disabled by default and is only\nmade after an administrator enables the installation notice in ARACNE \u2192 Ajustes. From then on the\nsite sends, when the option is enabled and then once a day: the installation ID, the site URL, the\nadministrator email, the WordPress version and the plugin version. Disabling the option stops the\nrequests.<\/p>\n\n<ul>\n<li>Service: https:\/\/aracne.cerwall.com<\/li>\n<li>Privacy policy: https:\/\/cerwall.com\/terms<\/li>\n<li>Legal notice and terms of use: https:\/\/cerwall.com\/aviso<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Install the plugin from Plugins \u2192 Add New, or upload the <code>aracne-security<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate it from the Plugins screen.<\/li>\n<li>Open <strong>ARACNE \u2192 Esc\u00e1ner<\/strong> to see the score and <strong>ARACNE \u2192 Ajustes<\/strong> to configure hardening.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20it%20send%20data%20outside%20my%20site%3F\"><h3>Does it send data outside my site?<\/h3><\/dt>\n<dd><p>No, unless you enable the installation notice in Ajustes.<\/p><\/dd>\n<dt id=\"what%20changes%20when%20aracne%20pro%20is%20installed%3F\"><h3>What changes when ARACNE Pro is installed?<\/h3><\/dt>\n<dd><p>The add-on is activated alongside this plugin and adds its modules to the same menu. The settings of this version are kept.<\/p><\/dd>\n<dt id=\"what%20is%20removed%20when%20the%20plugin%20is%20deleted%3F\"><h3>What is removed when the plugin is deleted?<\/h3><\/dt>\n<dd><p>Deleting it from the Plugins screen removes its settings, temporary data, scheduled tasks and its block in the .htaccess file. If ARACNE Pro is still installed, the data the add-on needs to keep its license is kept.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.1.8<\/h4>\n\n<ul>\n<li>The readme describes the plugin screenshots.<\/li>\n<\/ul>\n\n<h4>1.1.7<\/h4>\n\n<ul>\n<li>The scanner reports signs of intrusion: hidden administrators, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress.<\/li>\n<\/ul>\n\n<h4>1.1.6<\/h4>\n\n<ul>\n<li>The setup wizard names the button that finishes it as it appears on screen.<\/li>\n<\/ul>\n\n<h4>1.1.5<\/h4>\n\n<ul>\n<li>The main plugin file is named after the plugin slug: aracne-security.php.<\/li>\n<li>The scanner styles and notices are loaded with wp_enqueue_style() and wp_add_inline_script() instead of inline tags.<\/li>\n<li>The .htaccess block is removed through the WordPress Filesystem API, without error suppression.<\/li>\n<li>The External services section links to the service, its privacy policy and its legal notice.<\/li>\n<\/ul>\n\n<h4>1.1.4<\/h4>\n\n<ul>\n<li>The admin screens use the Open Sans font bundled with the plugin (SIL Open Font License 1.1) and no longer load fonts from external servers.<\/li>\n<li>The REST API users check builds its URL with rest_url(), so it works with custom REST prefixes.<\/li>\n<li>The Contributors field lists the plugin owner's WordPress.org username.<\/li>\n<\/ul>\n\n<h4>1.1.3<\/h4>\n\n<ul>\n<li>Coding standards: the WordPress core constant DISALLOW_FILE_EDIT is documented as an allowed exception to the plugin prefix rule.<\/li>\n<li>The installation instructions name the aracne-security folder.<\/li>\n<\/ul>\n\n<h4>1.1.2<\/h4>\n\n<ul>\n<li>The text domain matches the WordPress.org slug, aracne-security; translations are loaded from WordPress.org.<\/li>\n<\/ul>\n\n<h4>1.1.1<\/h4>\n\n<ul>\n<li>The help and ARACNE Pro links point to cerwall.com.<\/li>\n<li>Request data is unslashed and sanitized before use, and the admin views escape all output.<\/li>\n<li>Tested with WordPress 7.1.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>User enumeration blocking also covers the WordPress users sitemap.<\/li>\n<li>The scanner verifies the certificate in requests to the site itself, and its token is only valid for the URL it checks.<\/li>\n<li>Deleting the plugin removes its settings, temporary data, scheduled tasks and its .htaccess block.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release: exposure scanner, security score and basic WordPress hardening.<\/li>\n<li>Optional installation notice, disabled by default.<\/li>\n<\/ul>","raw_excerpt":"Exposure scanner with a security score and basic WordPress hardening.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/394800","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=394800"}],"author":[{"embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/jfernandezcerwall"}],"wp:attachment":[{"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=394800"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=394800"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=394800"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=394800"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=394800"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/sr.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=394800"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}