# maca Sec – Guide and Features

maca Sec brings firewall, login protection, 2FA, hardening, scanning, and logging together in one place. All features are included with no premium locks.

This guide describes what each part does and how to use them in WordPress admin under **maca Sec** in the sidebar menu.

---

## Getting Started

### 1. Install and Activate

1. Upload the plugin via **Plugins → Add New → Upload Plugin** or place the `maca-sec` folder in `wp-content/plugins/`.
2. Activate **maca Sec** under **Plugins**.
3. You are redirected to **Terms & Policy** — read and accept the **Terms of Use** and **Privacy Policy** with the checkboxes.
4. Click **Accept and Continue**. Security protection is activated automatically.

> If the terms are updated in a later version, you must accept again. Until then, protection is paused and you will see a notice in wp-admin.

### 2. Recommended Order After Installation

1. Open **Dashboard** and note the security score.
2. Run **Scanner → Run Scan Now** and fix critical issues.
3. Add your IP to **Firewall → IP Allowlist** (the **My IP** button).
4. Enable **2FA** under **Users → Your Profile**.
5. Enter **alert email** under **Hardening**.
6. Review firewall rules and enable captcha if needed.
7. Test the site in a private window after changes.

**Before production:** take a backup, test login and checkout/payment, and verify that you are not blocking yourself or legitimate visitors.

---

## Overview

The table below summarizes **what each module does** and **which threats it is meant to stop**. Details and settings are in the respective sections further down.

| Module | What it does | Protects against | Settings |
|--------|--------------|------------------|----------|
| **Firewall (WAF)** | Analyzes incoming requests against known attack patterns in URLs, forms, and headers | SQL injection, XSS, path traversal, executable uploads, spoofed Referer headers | Firewall |
| **Rate limiting** | Counts requests per IP per minute, per area (site, login, admin, XML-RPC, REST) | Brute force, credential stuffing, scraping, bot traffic against sensitive endpoints | Firewall |
| **Smart rate limiting** | Weighs behavioral signals (burst, URL patterns, cookies, referer) before blocking | Aggressive scanners, automated exploits, bots without normal browser behavior — fewer false positives than plain IP blocking | Firewall |
| **AI bots** | Identifies known AI crawlers via User-Agent and applies per-bot policy | Unwanted AI training/scraping, bandwidth theft, indexing bots that ignore robots.txt | Firewall |
| **Attack shield** | Enables temporary maintenance mode (HTTP 503) under extreme load | Volumetric DDoS-like attacks, overload that risks taking down the server | Firewall |
| **Login protection** | Limits failed logins, hides errors, and can require captcha/strong passwords | Brute force, password spraying, username enumeration | Login |
| **Honeypot traps** | Offers fake paths that only bots/scanners typically try to access | Automated scanners, path guessing, bots hunting weak login or API endpoints | Login |
| **Session management** | Logs out inactive users and shows active sessions | Abandoned admin sessions on shared computers, session hijacking after an unattended screen | Login |
| **2FA** | Requires a one-time code in addition to the password at login | Stolen or leaked passwords, credential stuffing even when the password is known | Users → Profile |
| **Hardening** | Closes common WordPress attack surfaces and limits exposed information | File editing via admin, XML-RPC abuse, author/user enumeration, pingback floods | Hardening |
| **HTTP headers** | Adds security headers to HTTP responses | Clickjacking, MIME sniffing, unwanted referrer leakage, unauthorized camera/microphone access in the browser | Hardening |
| **Scanner** | Checks configuration, files, and accounts for security gaps | Wrong file permissions, suspicious code, weak admin accounts, missing 2FA, outdated PHP | Scanner |
| **File monitoring** | Compares hashes on critical files against an approved baseline | Unauthorized file changes, backdoors, compromised config files after intrusion | Scanner |
| **CVE scanning** | Compares installed plugins/themes against the WPScan database | Known vulnerabilities (CVE) in third-party code that attackers can exploit | Scanner |
| **Supply chain guard** | Monitors plugin integrity, author changes, and WP.org checksums | Compromised plugin updates, bought/hacked extensions, malicious code via the supply chain | Supply chain & AI |
| **Behavior detection** | Calculates a risk score 0–100 for REST/POST behavior | Unusual API calls, unauthenticated writes, exploit patterns missed by signature WAF | Supply chain & AI |
| **Security log** | Collects and filters all security events | — (visibility and traceability during incidents, not a blocking control itself) | Logs |
| **maca Hub** | Remote control, allowlist sync, and status in the maca Hub app | — (administration and overview, not a threat block itself) | maca Hub app |
| **Collective threat intel** | Anonymously reports attacks to the Hub network and receives shared blocks | Repeat attackers already stopped on hundreds of other sites | maca Hub app |
| **Filesystem guard 2.0** | Deep-scans uploads/themes for new PHP files and webshell signatures | Uploaded backdoors, malicious code with eval/Base64/gzinflate | Scanner |
| **Health score** | Holistic score 0–100 with checklist on the dashboard | Overview of PHP, HTTPS, 2FA, WAF, CVEs, and updates | Dashboard |
| **Live Attack Map** | Real-time data to maca Hub (map in the app) | Visualizes protection in action — attacks/min, countries, types | maca Hub app |

All security events are logged under **maca Sec → Logs**.

---

## Sidebar Menu at a Glance

| Page | What You Do Here |
|------|------------------|
| **Dashboard** | Overview: score, events, blocked IPs, module status |
| **Scanner** | Security scan, file monitoring, CVE/WPScan |
| **Settings** | Firewall, login, hardening, supply chain & AI, maca Hub app (tabs) |
| **Logs** | Filter, search, block IP, approve file changes |
| **Guide** | This guide |
| **Terms & Policy** | Read and accept legal documents |

Under **Settings** you will find the tabs **Firewall**, **Login**, **Hardening**, **Supply chain & AI**, and **maca Hub app**.

---

## Firewall

**maca Sec → Settings → Firewall**

The firewall runs early on every page request and analyzes incoming traffic. Logged-in administrators in wp-admin bypass the firewall so settings can be saved normally.

### WAF Rules

| Rule | Protects Against |
|------|-----------------|
| SQL injection | Common SQL injection patterns in URLs and forms |
| XSS | Script tags and dangerous input |
| Path traversal | `../` patterns and directory traversal |
| Dangerous uploads | `.php`, `.phtml`, `.phar`, etc. |
| Spoofed Referer | Fake Referer headers |

### User-Agent Blocking

- **Scanners & exploit tools** — nikto, wpscan, sqlmap, masscan, nmap, etc.
- **CLI tools** (optional) — curl, wget, python-requests. *May affect legitimate API clients.*
- **Empty User-Agent** (optional) — requests without a User-Agent.
- **Custom strings** — one string per line, matched if the User-Agent contains the text.

### Rate Limiting

**What it does:** Counts how many requests each IP address makes per minute and stops traffic that exceeds the limit.

**Protects against:** Brute force against login, massive calls to wp-admin or the REST API, XML-RPC floods, and general bot flows that try to overload or scan the site.

Default values:

| Area | Default |
|------|---------|
| Entire website | 100/min |
| wp-login.php | 20/min |
| wp-admin | 60/min |
| xmlrpc.php | 10/min |
| REST API | 100/min |

**Smart rate limiting** (optional, on by default) weighs burst speed, unique URLs, HTTP method, cookies, referer, and suspicious URL patterns.

**Strict smart rate limiting** lowers the thresholds (fewer requests per second and fewer unique URLs are needed for a higher risk score). Enabled in the *Maximum protection* profile — stops scanners faster but may cause more 429s for very fast legitimate flows.

**Protects against:** Aggressive scanners and automated attacks that spread across many URLs in a short time, write requests without cookies (e.g. exploit attempts), and bots that lack normal browser behavior. Fewer false positives than plain IP blocking — legitimate visitors with cookies and normal browsing are rarely affected.

| Signal | Why it counts |
|--------|---------------|
| Burst speed | Many requests in a few seconds suggests automation |
| Many unique URLs | Scanners map the site systematically |
| Writes without cookies | Exploit attempts against forms/API without a session |
| Missing referer | Bots jump directly between URLs without normal navigation |
| Suspicious URLs | e.g. `wp-config`, `.env`, `shell.php` |

### AI Bots

**What it does:** Recognizes known AI crawlers via User-Agent and applies your chosen policy per bot.

**Protects against:** Unwanted scraping for AI training, bandwidth theft, and indexing bots that may publish your content in AI services without your consent. Blocking stops the bot entirely; limiting lets it crawl at a low rate.

Per-bot policy for known AI crawlers:

| Bot | Default |
|-----|---------|
| GPTBot | Limit |
| ClaudeBot | Limit |
| Bytespider | Block |
| PerplexityBot | Limit |
| Amazonbot | Allow |

**Allow** — no action. **Block** — HTTP 403. **Limit** — max requests per minute per IP (default 15/min). Allowlisted IPs are not affected.

### Attack Shield

**What it does:** Puts the entire website in temporary maintenance mode (HTTP 503) when traffic exceeds a high threshold.

**Protects against:** Volumetric DDoS-like attacks and traffic spikes that could otherwise take down PHP/MySQL or make the site unusable for all visitors.

Enables maintenance mode (HTTP 503) under extreme traffic. Default: threshold 500 requests/minute, duration 600 seconds. If the shield is active, a red warning is shown on the firewall page.

### Country Code Blocklist

Block visitors from selected countries using ISO codes (e.g. `RU, CN`). Allowlisted IPs are not affected.

Country code is retrieved from Cloudflare/server headers when possible, otherwise via ip-api.com (cached for 7 days). If the country code **cannot** be determined, the visitor is **not** blocked by the country code rule.

> **Tip:** Always add your own IP to the allowlist before enabling country blocks.

### IP Allowlist

Allowlisted IP/CIDR bypass the firewall, country blocking, and login blocks. Use the **My IP** button to quickly add your address. CIDR is supported, e.g. `192.168.1.0/24`.

If maca Hub is connected, you can sync allowlisted IPs to all your Hub sites.

### Blocked IP Addresses

View, unblock, or allowlist IPs that have been blocked automatically or manually. Blocks can be temporary or permanent.

---

## Login Protection

**maca Sec → Settings → Login**

### Brute Force Protection

**What it does:** Counts failed login attempts per IP and temporarily blocks when the limit is reached.

**Protects against:** Brute force and password spraying against `wp-login.php` — automated attempts to guess administrator passwords.

- **Max login attempts** — default 5 failed attempts.
- **Block duration** — default 900 seconds (15 minutes).
- **Hide login errors** — shows a generic error message (counteracts username enumeration).
- **Require strong passwords** — at least 12 characters with uppercase/lowercase letters, numbers, and special characters.

Allowlisted IPs skip brute force blocks and captcha.

### Email Alerts on Login

Sends email on suspicious login attempts (with country code when available). Uses the same email address as under **Hardening → Alert Email**. You specify after how many attempts the alert should be sent — once per IP and block period.

### Inactive Logout

Automatically logs out inactive users — protects abandoned admin sessions.

| Setting | Default |
|---------|---------|
| Timeout | 60 minutes |
| Warning before logout | 5 minutes |
| Scope | wp-admin only |
| Remember me | Applies to these sessions too |

A dialog is shown before logout so the user can extend the session.

### Spam Control

- **Honeypot** — always active. Hidden field on the login page that catches bots.
- **Captcha** — choose provider:
  - Math (no API key)
  - Google reCAPTCHA v2 (checkbox)
  - Google reCAPTCHA v3 (invisible, threshold 0.0–1.0)
  - Cloudflare Turnstile

Register site key and secret key for the chosen provider. The domain must match `wp-login.php`.

### Honeypot Traps

**What it does:** Offers fake URLs that do not exist in WordPress but that bots and scanners often test automatically.

**Protects against:** Automated path scanners, bots hunting weak login pages, XML-RPC, and REST endpoints — and exposes attackers early by logging and blocking the IP.

Fake paths that lure bots and scanners — not the same as the login honeypot field above.

| Trap | Example |
|------|---------|
| Fake login | `/login.php`, `/wp-login.php.bak` |
| Fake XML-RPC | `/xmlrpc2.php` |
| Fake REST endpoints | `/wp-json/wp/v2/superadmin`, `/wp-json/api/v1/token` |

On a hit, **IP, country, ASN, and User-Agent** are logged. The IP is permanently blocked by default (can be disabled under **Login → Honeypot traps**). Add custom paths, one per line.

Recent hits are shown on the same page.

### Active Sessions

Shows your logged-in devices (device, IP, time). The **Log Out All Other Sessions** button ends other sessions.

### Two-Factor Authentication (2FA)

2FA is enabled per user under **Users → Profile**:

1. Enable 2FA and scan the QR code with Google Authenticator, Authy, or 1Password.
2. Save the **recovery codes** in a secure place.
3. When logging in, enter the one-time code after your password.

---

## Hardening

**maca Sec → Settings → Hardening**

### Basic Hardening

| Setting | Effect |
|---------|--------|
| Disable file editor | Removes **Appearance → Theme File Editor** and the plugin editor |
| Hide WordPress version | Does not show version in HTML |
| Remove generator meta | Removes `<meta name="generator">` |
| Disable XML-RPC | Blocks xmlrpc.php (unless already off via login settings) |
| Block author enumeration | Stops `?author=1` enumeration |
| Hide users in REST API | Anonymizes the user list in `/wp-json/wp/v2/users` |
| Disable pingbacks | Turns off pingbacks |
| Disable WP-Cron on page visits | Stops automatic cron on page loads — requires server cron (see info box in admin) |
| Strip ?ver= from CSS/JS | Removes version query args from plugin and theme asset URLs |
| Block readme/license in themes and plugins | 403 on readme.txt/html and license.txt under wp-content |
| Block readme.html and license.txt in web root | 403 on standard files in the WordPress root |
| Block direct access to wp-includes/version.php | Prevents common WordPress version fingerprinting |
| Hotlink protection | 403 if an external site links directly to your images |
| Limit post revisions | Default 10 revisions per post |

#### WP-Cron (server cron)

When **Disable WP-Cron on page visits** is on, scheduled jobs no longer run automatically when someone visits the site. This reduces load and makes it harder to abuse `wp-cron.php` via visitor traffic.

**Important:** You must set up a recurring job with your hosting provider (cron, scheduled tasks, Task Scheduler). maca Sec shows an info box with example commands (HTTP with curl/wget or WP-CLI) tailored to your site — not tied to a specific provider.

Without a replacement, scheduled posts, update checks, and plugin jobs will stop running on time.

#### Fingerprint protection

| Setting | Effect |
|---------|--------|
| Strip ?ver= from CSS/JS | Version numbers disappear from plugin and theme URLs (style.css may still contain `Version:` in the file) |
| Block readme/license in themes and plugins | 403 on readme and license under `wp-content/themes` and `wp-content/plugins` |
| Block readme.html and license.txt in web root | 403 on standard files in the WordPress root |
| Block wp-includes/version.php | Stops direct HTTP access to the WordPress version file |

### HTTP Security Headers

| Header | Description |
|--------|-------------|
| X-Frame-Options | SAMEORIGIN or DENY — counteracts clickjacking |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | Controls how much referrer info is sent |
| Permissions-Policy | Restricts camera, microphone, etc. |
| Content-Security-Policy | Optional CSP — *may break some themes/plugins, test carefully* |
| HSTS | Enabled automatically over HTTPS |

### Notifications

- **Alert email** — empty = WordPress admin email. Receives mail on critical events and file changes.
- **Log retention** — default 30 days. Older logs are cleaned up automatically.

---

## Scanner and File Monitoring

**maca Sec → Scanner**

### Security Scan

**What it does:** Checks the site against a checklist of common security gaps and gives a score of 0–100.

**Protects against:** Configuration errors and weaknesses attackers exploit before they even need an exploit — wrong file permissions, exposed files, weak accounts, and missing 2FA.

Click **Run Scan Now** for a full check. You get a **security score of 0–100** and a list of findings sorted by severity:

- **Critical** — fix immediately
- **Warning** — should be addressed
- **Info** — recommendations

The scanner checks among other things file permissions, suspicious code, admin accounts, 2FA status, PHP version, configuration, and whether the active theme exposes a version line in `style.css`.

**Fix** — some issues can be resolved with one button directly in the list.

**Approve** — if you intentionally made a change (e.g. custom code in a theme), you can approve the finding so it does not lower the score. Use only if you know the change is intentional and safe.

### File Monitoring

**What it does:** Computes hashes on selected files and warns when content changes without an approved baseline. For **`.htaccess`** and **`wp-config.php`**, redacted content snapshots are also stored so you can see a **line-by-line diff**, **SHA-256 before/after**, and (when determinable) a **probable writer** — e.g. WordPress permalinks, the plugin/theme editor, or an update.

**Protects against:** Unauthorized file changes after intrusion — e.g. backdoors in `wp-config.php`, manipulated `.htaccess`, or compromised plugin files.

| File/Area | Default |
|-----------|---------|
| wp-config.php | Monitored (diff + SHA-256) |
| .htaccess | Monitored (diff + SHA-256) |
| Active plugins (main file) | Off |
| All maca Sec files | Off |

If a change occurs without an approved baseline, a warning is shown in wp-admin with **Show diff** under Scanner and in Logs. You can **approve** the file change in **Logs** or **Scanner** to update the baseline.

> **Note:** IP/user in the list is who was active when the change was *detected*, not necessarily who wrote the file. External writes (FTP/SSH) are marked as unknown writer. Secrets in `wp-config.php` (passwords, salts) are redacted (`[REDACTED]`) before snapshot, log, and Hub.

### CVE Scanning (WPScan)

**What it does:** Compares installed plugins and themes against WPScan's database of known vulnerabilities (CVE).

**Protects against:** Exploitation of publicly known vulnerabilities in third-party code — often the first thing attackers test after a CVE is published.

1. Create a free API token at wpscan.com.
2. Enable CVE scanning and paste the token under **Scanner**.
3. Scanning runs in batch once per day (scheduled).

The **plugin vulnerability table** shows status per installed plugin:

| Status | Meaning |
|--------|---------|
| **High risk** | Critical or high CVE in your installed version (e.g. CVE-2026-9050) |
| **Update soon** | Lower CVE or new version available |
| **No known vulnerability** | Scanned with no WPScan match |
| **Awaiting scan** | Not yet scanned in the daily batch |

New high-risk CVEs are logged as critical events and may trigger email alerts.

---

## Supply Chain & Behavior Analysis

**maca Sec → Settings → Supply chain & AI**

Two advanced modules that protect against compromised plugin updates and unusual attack patterns.

### Supply Chain Guard

Monitors installed plugins for supply chain attacks — when attackers acquire plugins, compromise CDNs, or publish malicious updates.

| Feature | What It Does |
|---------|--------------|
| **Author changes** | Warns when a plugin's author or author URL changes |
| **WordPress.org checksums** | Compares files against official checksums from WordPress.org |
| **Removed from WP.org** | Warns when a previously verified plugin is no longer on wordpress.org |
| **External JS in admin** | Detects unknown external JavaScript domains in wp-admin |
| **New admin domains** | Builds a baseline and warns when new domains load from the admin panel |

Checks run daily in batches (a few plugins at a time) and on plugin updates. Warnings appear on **Supply chain & AI** and in **Logs** (type: supply chain).

> On the first wp-admin visit, a silent baseline is built for admin domains — no false alarms for existing extensions.

### Behavior Detection (Risk Score 0–100)

Heuristic analysis of incoming requests — not external AI, but behavior-based detection that complements signature-based firewall rules:

- Unusual **POST** requests
- **REST API** analysis (unauthenticated writes, unknown routes)
- Known exploit patterns in payloads
- Repeated suspicious attempts from the same IP increase the score

Example log message:

> Risk score 91/100 – POST REST: Unusual REST API pattern; Unauthenticated REST API write

| Setting | Default | Description |
|---------|---------|-------------|
| Log threshold | 50 | Requests at or above this score are logged |
| Block threshold | 85 | Critical level — can combine with automatic IP blocking |
| Auto-block IP | Off | Permanent block when score ≥ block threshold |

> **Tip:** Leave auto-block off until you see how thresholds behave on your site. Whitelisted IPs are not analyzed.

---

## Logs

**maca Sec → Logs**

All security events are collected here with filtering and pagination (50 per page).

### Filter

- **Type** — e.g. firewall, login, file_monitor, supply_chain, behavior, legal_accepted
- **Severity** — info, warning, critical
- **IP address** — partial match
- **Search message** — free text
- **Date range** — from/to

### Actions per Row

- **Copy** — copy IP to clipboard
- **Block IP** — permanent block (with confirmation; warning if it is your own IP)
- **Approve** — approve file change directly from the log

### Critical Events

If there are critical events in the last 24 hours, a red admin notice is shown. Close with × to hide until the count increases. You can **reset the notice** from the logs page.

---

## maca Hub App

**maca Sec → Settings → maca Hub app**

Requires maca Hub Connector and connection to the maca Hub app.

### Security Protection

Main switch for maca Sec. When turned off, no protection modules run on the site. maca Hub can still turn protection on or off via API if configured.

### Terms After Update via Hub

If maca Sec is updated via maca Hub and new terms or policy are included:

1. **Protection is paused automatically** until an administrator accepts in wp-admin.
2. **Acceptance cannot be done from the app** — only under **maca Sec → Terms & Policy**.
3. maca Hub then shows that protection **is not active** (`protection_active: false`) and that **action is required** (`legal_action_required: true`).
4. If protection was on before the update, that choice is saved (`protection_requested: true`), but protection does not run until you have accepted.

**How to accept after a Hub update:**

1. Open wp-admin (directly or via Hub → wp-admin login).
2. Click the red notice at the top, or go to **maca Sec → Terms & Policy**.
3. Read the documents, check both boxes, and click **Accept and Continue**.
4. Protection is re-enabled automatically if it was on before the pause.

> maca Hub cannot enable protection until the terms are accepted in wp-admin.

### Collective Threat Intelligence

**What it does:** Anonymously reports attack signals (IP, type, User-Agent, exploit pattern) to maca Hub and receives blocks already seen on other maca Sec sites.

**Protects against:** Repeat attackers and new exploit patterns spreading across the network — e.g. *"New attack detected. 847 sites have already blocked it."*

| Setting | Default |
|---------|---------|
| Network intelligence | Off |
| Anonymous reporting | On |
| Auto-block | Off |
| Minimum sites | 3 |

### Live Attack Map

The maca Hub app can show a **live map** with data from your site: attacks per minute, countries, attack types, latest exploits, and blocked IPs. Data is sent via Hub sync — the map itself is rendered in the app.

---

## Health Score and Filesystem Guard 2.0

### Health Score (Dashboard)

Holistic score **0–100** with checklist:

- ✓ PHP up to date
- ✓ HTTPS
- ✓ 2FA for administrators
- ✓ WAF active
- ✓ No known high-risk CVEs
- ⚠ Plugins needing updates

Different from the **scan score**, which only measures the latest security scan.

### Filesystem Guard 2.0

Extends file monitoring with deep scanning of **uploads** and **themes**:

- New PHP files
- Base64 code, `eval()`, `gzinflate()`, and other webshell signatures
- Suspicious filenames (e.g. `shell.php`, random hex names)

Enable under **Scanner → File monitoring → Filesystem guard 2.0**.

### Remote Actions

- **Allow from app** — allow security scanning and wp-admin login from the maca Hub app.
- **Hub allowlist** — receive and send allowlisted IPs to all connected Hub sites.

---

## Terms & Policy

**maca Sec → Terms & Policy**

Here you read and accept:

- **Terms of Use** — liability, warranties, and limitations
- **Privacy Policy** — how data is handled locally and via third-party services

Acceptance is saved with document version, timestamp, and administrator. When documents are updated, you must accept again — until then, security protection is paused.

---

## What Blocked Visitors See

Simple error page with HTTP 403:

| Cause | Title | Message |
|-------|-------|---------|
| Country code blocklist | Access denied | Access denied from your country. |
| IP blocklist | Access denied | IP blocked |
| WAF rule | Access denied | Request blocked / Access denied |
| Rate limiting | — | Too many requests |
| Smart rate limiting | Rate limiting | Too many requests (behavior-based) |
| AI bot (blocked) | AI bot blocked | Access denied |
| AI bot (limited) | AI bot limited | Too many requests |
| Behavior detection | — | Access denied (with auto-block) |
| Attack shield | — | HTTP 503 (maintenance mode) |

When logging in from a blocked IP: *Too many failed attempts. Try again later.*

---

## Security Score – What Does It Mean?

| Score | Meaning |
|-------|---------|
| 80–100 | Good — the site is well protected |
| 50–79 | OK — there are improvements to make |
| 0–49 | Warning — fix critical issues immediately |

The score is based on the latest scan and is not affected by approved findings.

---

## Tips and Troubleshooting

### Cannot Save Settings or Getting 503

Update to the latest version. The firewall should not block admin saves. Verify that your IP is not blocked.

### Blocking Myself

1. Disable the plugin via hosting/FTP (rename the `maca-sec` folder).
2. Remove your IP from the database table `wp_maca_sec_blocked_ips`.
3. Or allowlist your IP first via database/hosting and activate again.

### Country Block Not Working

Requires country code header from Cloudflare/server, or outbound HTTP from the server to ip-api.com.

### reCAPTCHA/Turnstile Not Showing

Check site key and secret key. The domain in the provider panel must match your site and `wp-login.php`.

### Captcha or Firewall Blocking Legitimate Users

Allowlist trusted IPs. Lower rate limiting thresholds. Disable CLI blocking if API clients are affected.

### Warning from Another Security Plugin

maca Sec is not always recognized by other plugins — that does not mean it is inactive.

### One Security Plugin at a Time

Do not run maca Sec together with Wordfence, iThemes Security, or similar — risk of conflicts and double blocking.

### File Monitoring Alerts After Plugin Update

Approve the file changes in **Scanner** or **Logs** if the update was intentional, so the baseline is updated.

### maca Hub Cannot Enable Protection

Accept terms and policy under **Terms & Policy** in wp-admin first.

### Uninstall

When removed via WordPress admin, cleanup runs automatically: settings, logs, IP lists, 2FA metadata, and scheduled jobs are removed.

---

## System Requirements

| Requirement | Version |
|-------------|---------|
| WordPress | 6.0 or later |
| PHP | 7.4+ (8.1+ recommended) |
| Database | MySQL or MariaDB |

---

## Related Documents

- **Terms & Policy** — in wp-admin under maca Sec
- **maca.se** — [https://maca.se/](https://maca.se/)
