XeroWP
ARACNE Security
ARACNE Security

ARACNE Security

0/5 (0 ratings) — active installs Updated Nov 9, 2026
hardeningscannersecurityuser enumerationxml-rpc
Download v1.1.9 Plugin Website
Exposure scanner: security score from 0 to 100 and each risk found, with what it is, why it matters and how to fix it.

Exposure scanner: security score from 0 to 100 and each risk found, with what it is, why it matters and how to fix it.

ARACNE analyses the exposure of your WordPress site and applies basic hardening measures.
Everything runs on your own server.

  • Exposure scanner — checks for publicly accessible sensitive files (.env, .git, wp-config backups, debug.log), XML-RPC, user enumeration, visible version, security headers, directory listing, readme.html, the file editor, the “admin” user, the table prefix, the PHP and WordPress versions, plugins and themes with pending updates and WP_DEBUG. It also reports common signs of intrusion: administrators hidden from the Users screen, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress.
  • Security score — a rating from 0 to 100 with an explanation of each risk.
  • Basic hardening — blocks user enumeration, hides the WordPress version, blocks readme.html/license.txt, removes X-Powered-By, hides the REST index, makes login errors generic, disables the file editor, and optionally disables XML-RPC and Application Passwords.

ARACNE Pro

ARACNE Pro is a paid add-on, distributed by Cerwall from aracne.cerwall.com, that adds a WAF,
protection profiles, progressive IP blocking, a bot filter, IP lists, security headers and CSP,
.htaccess management, integrations with site management platforms, reports and alerts. This free
version works without the add-on and has no time limit.

External services

The scanner only sends HTTP requests to your own site.

This plugin can connect to the ARACNE service at https://aracne.cerwall.com, operated by Cerwall
Solutions S.L., to register the installation. The connection is disabled by default and is only
made after an administrator enables the installation notice in ARACNE Ajustes. From then on the
site sends, when the option is enabled and then once a day: the installation ID, the site URL, the
administrator email, the WordPress version and the plugin version. Disabling the option stops the
requests.

  • Service: https://aracne.cerwall.com
  • Privacy policy: https://cerwall.com/terms
  • Legal notice and terms of use: https://cerwall.com/aviso