ARACNE Security

ARACNE analyses the exposure of your WordPress site and applies basic hardening measures.
Everything runs on your own server.

• Exposure scanner — checks for publicly accessible sensitive files (.env, .git, wp-config backups, debug.log), XML-RPC, user enumeration, visible version, security headers, directory listing, readme.html, the file editor, the “admin” user, the table prefix, the PHP and WordPress versions and WP_DEBUG. It also reports common signs of intrusion: administrators hidden from the Users screen, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress.
• Security score — a rating from 0 to 100 with an explanation of each risk.
• Basic hardening — blocks user enumeration, hides the WordPress version, blocks readme.html/license.txt, removes X-Powered-By, hides the REST index, makes login errors generic, disables the file editor, and optionally disables XML-RPC and Application Passwords.

ARACNE Pro

ARACNE Pro is a paid add-on, distributed by Cerwall from aracne.cerwall.com, that adds a WAF,
protection profiles, progressive IP blocking, a bot filter, IP lists, security headers and CSP,
.htaccess management, integrations with site management platforms, reports and alerts. This free
version works without the add-on and has no time limit.

External services

The scanner only sends HTTP requests to your own site.

This plugin can connect to the ARACNE service at https://aracne.cerwall.com, operated by Cerwall
Solutions S.L., to register the installation. The connection is disabled by default and is only
made after an administrator enables the installation notice in ARACNE → Ajustes. From then on the
site sends, when the option is enabled and then once a day: the installation ID, the site URL, the
administrator email, the WordPress version and the plugin version. Disabling the option stops the
requests.

• Service: https://aracne.cerwall.com
• Privacy policy: https://cerwall.com/terms
• Legal notice and terms of use: https://cerwall.com/aviso