=== ARACNE Security ===
Contributors: jfernandezcerwall
Tags: security, scanner, hardening, xml-rpc, user enumeration
Requires at least: 5.6
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.7
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Exposure scanner with a security score and basic WordPress hardening.

== Description ==

ARACNE analyses the exposure of your WordPress site and applies basic hardening measures.
Everything runs on your own server.

* **Exposure scanner** — checks for publicly accessible sensitive files (.env, .git, wp-config backups, debug.log), XML-RPC, user enumeration, visible version, security headers, directory listing, readme.html, the file editor, the "admin" user, the table prefix, the PHP and WordPress versions and WP_DEBUG. It also reports common signs of intrusion: administrators hidden from the Users screen, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress.
* **Security score** — a rating from 0 to 100 with an explanation of each risk.
* **Basic hardening** — blocks user enumeration, hides the WordPress version, blocks readme.html/license.txt, removes X-Powered-By, hides the REST index, makes login errors generic, disables the file editor, and optionally disables XML-RPC and Application Passwords.

= ARACNE Pro =

ARACNE Pro is a paid add-on, distributed by Cerwall from aracne.cerwall.com, that adds a WAF,
protection profiles, progressive IP blocking, a bot filter, IP lists, security headers and CSP,
.htaccess management, integrations with site management platforms, reports and alerts. This free
version works without the add-on and has no time limit.

= External services =

The scanner only sends HTTP requests to your own site.

This plugin can connect to the ARACNE service at https://aracne.cerwall.com, operated by Cerwall
Solutions S.L., to register the installation. The connection is disabled by default and is only
made after an administrator enables the installation notice in ARACNE → Ajustes. From then on the
site sends, when the option is enabled and then once a day: the installation ID, the site URL, the
administrator email, the WordPress version and the plugin version. Disabling the option stops the
requests.

* Service: https://aracne.cerwall.com
* Privacy policy: https://cerwall.com/terms
* Legal notice and terms of use: https://cerwall.com/aviso

== Installation ==

1. Install the plugin from Plugins → Add New, or upload the `aracne-security` folder to `/wp-content/plugins/`.
2. Activate it from the Plugins screen.
3. Open **ARACNE → Escáner** to see the score and **ARACNE → Ajustes** to configure hardening.

== Frequently Asked Questions ==

= Does it send data outside my site? =
No, unless you enable the installation notice in Ajustes.

= What changes when ARACNE Pro is installed? =
The add-on is activated alongside this plugin and adds its modules to the same menu. The settings of this version are kept.

= What is removed when the plugin is deleted? =
Deleting it from the Plugins screen removes its settings, temporary data, scheduled tasks and its block in the .htaccess file. If ARACNE Pro is still installed, the data the add-on needs to keep its license is kept.

== Changelog ==

= 1.1.7 =
* The scanner reports signs of intrusion: hidden administrators, administrators with a wordpress.org email, must-use plugins without a header and plugins that pose as part of WordPress.

= 1.1.6 =
* The setup wizard names the button that finishes it as it appears on screen.

= 1.1.5 =
* The main plugin file is named after the plugin slug: aracne-security.php.
* The scanner styles and notices are loaded with wp_enqueue_style() and wp_add_inline_script() instead of inline tags.
* The .htaccess block is removed through the WordPress Filesystem API, without error suppression.
* The External services section links to the service, its privacy policy and its legal notice.

= 1.1.4 =
* The admin screens use the Open Sans font bundled with the plugin (SIL Open Font License 1.1) and no longer load fonts from external servers.
* The REST API users check builds its URL with rest_url(), so it works with custom REST prefixes.
* The Contributors field lists the plugin owner's WordPress.org username.

= 1.1.3 =
* Coding standards: the WordPress core constant DISALLOW_FILE_EDIT is documented as an allowed exception to the plugin prefix rule.
* The installation instructions name the aracne-security folder.

= 1.1.2 =
* The text domain matches the WordPress.org slug, aracne-security; translations are loaded from WordPress.org.

= 1.1.1 =
* The help and ARACNE Pro links point to cerwall.com.
* Request data is unslashed and sanitized before use, and the admin views escape all output.
* Tested with WordPress 7.1.

= 1.1.0 =
* User enumeration blocking also covers the WordPress users sitemap.
* The scanner verifies the certificate in requests to the site itself, and its token is only valid for the URL it checks.
* Deleting the plugin removes its settings, temporary data, scheduled tasks and its .htaccess block.

= 1.0.0 =
* Initial release: exposure scanner, security score and basic WordPress hardening.
* Optional installation notice, disabled by default.
