Title: ARACNE Security Author: CERWALL_SOLUTIONS Published: November 5, 2026 Last modified: November 5, 2026 --- Search plugins ![](https://ps.w.org/aracne-security/assets/banner-772x250.png?rev=3786038) ![](https://ps.w.org/aracne-security/assets/icon-256x256.png?rev=3786038) # ARACNE Security By [CERWALL_SOLUTIONS](https://profiles.wordpress.org/jfernandezcerwall/) [Download](https://downloads.wordpress.org/plugin/aracne-security.1.1.8.zip) * [Details](https://wordpress.org/plugins/aracne-security/#description) * [Reviews](https://wordpress.org/plugins/aracne-security/#reviews) * [Installation](https://wordpress.org/plugins/aracne-security/#installation) * [Development](https://wordpress.org/plugins/aracne-security/#developers) [Support](https://wordpress.org/support/plugin/aracne-security/) ## Description ARACNE analyses the exposure of your WordPress site and applies basic hardening measures. Everything runs on your own server. * **Exposure scanner** — checks for publicly accessible sensitive files (.env, . git, wp-config backups, debug.log), XML-RPC, user enumeration, visible version, security headers, directory listing, readme.html, the file editor, the “admin” user, the table prefix, the PHP and WordPress versions and WP_DEBUG. It also reports common signs of intrusion: administrators hidden from the Users screen, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress. * **Security score** — a rating from 0 to 100 with an explanation of each risk. * **Basic hardening** — blocks user enumeration, hides the WordPress version, blocks readme.html/license.txt, removes X-Powered-By, hides the REST index, makes login errors generic, disables the file editor, and optionally disables XML-RPC and Application Passwords. #### ARACNE Pro ARACNE Pro is a paid add-on, distributed by Cerwall from aracne.cerwall.com, that adds a WAF, protection profiles, progressive IP blocking, a bot filter, IP lists, security headers and CSP, .htaccess management, integrations with site management platforms, reports and alerts. This free version works without the add-on and has no time limit. #### External services The scanner only sends HTTP requests to your own site. This plugin can connect to the ARACNE service at https://aracne.cerwall.com, operated by Cerwall Solutions S.L., to register the installation. The connection is disabled by default and is only made after an administrator enables the installation notice in ARACNE Ajustes. From then on the site sends, when the option is enabled and then once a day: the installation ID, the site URL, the administrator email, the WordPress version and the plugin version. Disabling the option stops the requests. * Service: https://aracne.cerwall.com * Privacy policy: https://cerwall.com/terms * Legal notice and terms of use: https://cerwall.com/aviso ## Screenshots [⌊Exposure scanner: security score from 0 to 100 and each risk found, with what it is, why it matters and how to fix it.⌉⌊Exposure scanner: security score from 0 to 100 and each risk found, with what it is, why it matters and how to fix it.⌉[ Exposure scanner: security score from 0 to 100 and each risk found, with what it is, why it matters and how to fix it. [⌊Basic hardening settings and the optional installation notice, disabled by default.⌉⌊ Basic hardening settings and the optional installation notice, disabled by default .⌉[ Basic hardening settings and the optional installation notice, disabled by default. [⌊Checks that already pass, with a short explanation of each one.⌉⌊Checks that already pass, with a short explanation of each one.⌉[ Checks that already pass, with a short explanation of each one. ## Installation 1. Install the plugin from Plugins Add New, or upload the `aracne-security` folder to `/wp-content/plugins/`. 2. Activate it from the Plugins screen. 3. Open **ARACNE Escáner** to see the score and **ARACNE Ajustes** to configure hardening. ## FAQ ### Does it send data outside my site? No, unless you enable the installation notice in Ajustes. ### What changes when ARACNE Pro is installed? The add-on is activated alongside this plugin and adds its modules to the same menu. The settings of this version are kept. ### What is removed when the plugin is deleted? Deleting it from the Plugins screen removes its settings, temporary data, scheduled tasks and its block in the .htaccess file. If ARACNE Pro is still installed, the data the add-on needs to keep its license is kept. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “ARACNE Security” is open source software. The following people have contributed to this plugin. Contributors * [ CERWALL_SOLUTIONS ](https://profiles.wordpress.org/jfernandezcerwall/) [Translate “ARACNE Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/aracne-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/aracne-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/aracne-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/aracne-security/) by [RSS](https://plugins.trac.wordpress.org/log/aracne-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.8 * The readme describes the plugin screenshots. #### 1.1.7 * The scanner reports signs of intrusion: hidden administrators, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress. #### 1.1.6 * The setup wizard names the button that finishes it as it appears on screen. #### 1.1.5 * The main plugin file is named after the plugin slug: aracne-security.php. * The scanner styles and notices are loaded with wp_enqueue_style() and wp_add_inline_script() instead of inline tags. * The .htaccess block is removed through the WordPress Filesystem API, without error suppression. * The External services section links to the service, its privacy policy and its legal notice. #### 1.1.4 * The admin screens use the Open Sans font bundled with the plugin (SIL Open Font License 1.1) and no longer load fonts from external servers. * The REST API users check builds its URL with rest_url(), so it works with custom REST prefixes. * The Contributors field lists the plugin owner’s WordPress.org username. #### 1.1.3 * Coding standards: the WordPress core constant DISALLOW_FILE_EDIT is documented as an allowed exception to the plugin prefix rule. * The installation instructions name the aracne-security folder. #### 1.1.2 * The text domain matches the WordPress.org slug, aracne-security; translations are loaded from WordPress.org. #### 1.1.1 * The help and ARACNE Pro links point to cerwall.com. * Request data is unslashed and sanitized before use, and the admin views escape all output. * Tested with WordPress 7.1. #### 1.1.0 * User enumeration blocking also covers the WordPress users sitemap. * The scanner verifies the certificate in requests to the site itself, and its token is only valid for the URL it checks. * Deleting the plugin removes its settings, temporary data, scheduled tasks and its .htaccess block. #### 1.0.0 * Initial release: exposure scanner, security score and basic WordPress hardening. * Optional installation notice, disabled by default. ## Meta * Version **1.1.8** * Last updated **3 days ago** * Active installations **Fewer than 10** * WordPress version ** 5.6 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [hardening](https://wordpress.org/plugins/tags/hardening/)[scanner](https://wordpress.org/plugins/tags/scanner/) [security](https://wordpress.org/plugins/tags/security/)[user enumeration](https://wordpress.org/plugins/tags/user-enumeration/) [xml-rpc](https://wordpress.org/plugins/tags/xml-rpc/) * [Advanced View](https://wordpress.org/plugins/aracne-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/aracne-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/aracne-security/reviews/) ## Contributors * [ CERWALL_SOLUTIONS ](https://profiles.wordpress.org/jfernandezcerwall/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/aracne-security/)