maca Sec brings together firewall, login protection, 2FA, hardening, scanning, and logging in one place. All features are included without premium locks.
This guide describes what each part does and how to use it in the WordPress admin under maca Sec in the sidebar menu.
Getting Started
1. Install and activate
- Upload the plugin via Plugins → Add New → Upload or place the
maca-secfolder inwp-content/plugins/. - Activate maca Sec under Plugins.
- You will be redirected to Terms & Policy — read and accept the terms of use and privacy policy using the checkboxes.
- Click Accept and continue. Security protection is activated automatically.
If the terms are updated in a later version, you must accept them again. Until then, protection is paused and you will see a notice in wp-admin.
2. Recommended order after installation
- Open Dashboard and note the security score.
- Run Scanner → Run scan now and fix critical issues.
- Add your IP to Firewall → IP whitelist (the My IP button).
- Enable 2FA under Users → Your Profile.
- Set the email for alerts under Hardening.
- Review firewall rules and enable captcha if needed.
- Test the site in a private window after changes.
Before production: make a backup, test login and cart/checkout, and make sure you do not lock yourself or legitimate visitors out.
Overview
| Module | Purpose | Settings |
|---|---|---|
| Firewall (WAF) | Stops attacks early | Firewall |
| Rate limiting | Limits requests per IP | Firewall |
| Attack shield | 503 during extreme traffic | Firewall |
| Login protection | Brute force, captcha, password | Login |
| Session management | Idle logout, active sessions | Login |
| 2FA | Two-factor authentication | Users → Profile |
| Hardening | Closes common WordPress holes | Hardening |
| HTTP headers | Security headers in responses | Hardening |
| Scanner | Configuration and file issues | Scanner |
| File monitoring | Changes in critical files | Scanner |
| CVE scanning | Known vulnerabilities (WPScan) | Scanner |
| Security log | Events and blocks | Logs |
| maca Hub | Remote control via app | maca Hub app |
All security events are logged under Maca Sec → Logs.
Sidebar at a glance
| Page | What you do here |
|---|---|
| Dashboard | Overview: score, events, blocked IPs, module status |
| Firewall | WAF, rate limiting, attack shield, country blocks, IP lists |
| Login | Brute force, captcha, email alerts, idle logout, sessions |
| Hardening | WordPress hardening, HTTP headers, email alerts, log retention |
| Scanner | Security scan, file monitoring, CVE/WPScan |
| Logs | Filter, search, block IP, approve file changes |
| maca Hub app | Turn protection on/off, remote actions, Hub whitelist |
| Terms & Policy | Read and accept legal documents |
| Guide | This guide |
Firewall
Maca Sec → Firewall
The firewall runs early on every page request and analyzes incoming traffic. Logged-in administrators in wp-admin bypass the firewall so settings can be saved normally.
WAF rules
| Rule | Protects against |
|---|---|
| SQL injection | Common SQL injection patterns in URLs and forms |
| XSS | Script tags and dangerous input |
| Path traversal | ../ patterns and directory traversal |
| Dangerous uploads | .php, .phtml, .phar, etc. |
| Spoofed Referer | Fake Referer headers |
User-Agent blocking
- Scanners & exploit tools — nikto, wpscan, sqlmap, masscan, nmap, etc.
- CLI tools (optional) — curl, wget, python-requests. May affect legitimate API clients.
- Empty User-Agent (optional) — requests without a User-Agent.
- Custom strings — one string per line, matched if the User-Agent contains the text.
Rate limiting
Limits the number of requests per IP and minute. Default values:
| Area | Default |
|---|---|
| Entire site | 100/min |
| wp-login.php | 20/min |
| wp-admin | 60/min |
| xmlrpc.php | 10/min |
| REST API | 100/min |
Attack shield
Activates maintenance mode (HTTP 503) during extreme traffic — protection against DDoS-like traffic. Default: threshold 500 requests/minute, duration 600 seconds. If the shield is active, a red warning is shown on the firewall page.
Country code blacklist
Block visitors from selected countries using ISO codes (e.g. RU, CN). Whitelisted IPs are not affected.
Country code is retrieved from Cloudflare/server headers if possible, otherwise via ip-api.com (cached for 7 days). If the country code cannot be determined, the visitor is not blocked by the country rule.
Tip: Always add your own IP to the whitelist before enabling country blocking.
IP whitelist
Whitelisted IP/CIDR bypass the firewall, country blocking, and login blocks. Use the My IP button to quickly add your address. CIDR is supported, for example 192.168.1.0/24.
If maca Hub is connected, you can sync whitelisted IPs to all your Hub sites.
Blocked IP addresses
View, unblock, or whitelist IPs that were blocked automatically or manually. Blocks can be temporary or permanent.
Login protection
Maca Sec → Login
Brute force protection
- Max login attempts — default 5 failed attempts.
- Block time — default 900 seconds (15 minutes).
- Hide login errors — shows a generic error message (prevents username enumeration).
- Require strong passwords — at least 12 characters with uppercase/lowercase letters, numbers, and special characters.
Whitelisted IPs skip brute force blocking and captcha.
Login email alerts
Sends email on suspicious login attempts (with country code if available). Uses the same email address as under Hardening → Email for alerts. You choose after how many attempts the alert should be sent — once per IP and block period.
Idle logout
Automatically logs out inactive users — protects abandoned admin sessions.
| Setting | Default |
|---|---|
| Timeout | 60 minutes |
| Warning before logout | 5 minutes |
| Scope | wp-admin only |
| Remember me | Also applies to those sessions |
A dialog appears before logout so the user can extend the session.
Spam protection
- Honeypot — always active. Hidden field on the login page that catches bots.
- Captcha — choose provider:
- Mathematical (no API key)
- Google reCAPTCHA v2 (checkbox)
- Google reCAPTCHA v3 (invisible, threshold 0.0–1.0)
- Cloudflare Turnstile
Register the site key and secret key for the selected provider. The domain must match wp-login.php.
Active sessions
Shows your logged-in devices (device, IP, time). The Log out all other sessions button ends the other sessions.
Two-factor authentication (2FA)
2FA is enabled per user under Users → Profile:
- Enable 2FA and scan the QR code with Google Authenticator, Authy, or 1Password.
- Store the recovery codes in a safe place.
- At login, enter the one-time code after the password.
Hardening
Maca Sec → Hardening
Basic hardening
| Setting | Effect |
|---|---|
| Disable file editor | Removes Appearance → Editor and the plugin editor |
| Hide WordPress version | Does not show version in HTML |
| Remove generator meta | Removes <meta name="generator"> |
| Disable XML-RPC | Blocks xmlrpc.php (if not already blocked via login) |
| Block author enumeration | Stops ?author=1 enumeration |
| Hide users in REST API | Anonymizes the user list in /wp-json/wp/v2/users |
| Disable pingbacks | Turns off pingbacks |
| Hotlink protection | 403 if an external site links directly to your images |
| Limit post revisions | Default 10 revisions per post |
HTTP security headers
| Header | Description |
|---|---|
| X-Frame-Options | SAMEORIGIN or DENY — prevents clickjacking |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | Controls how much referrer info is sent |
| Permissions-Policy | Restricts camera, microphone, etc. |
| Content-Security-Policy | Optional CSP — may break some themes/plugins, test carefully |
| HSTS | Automatically enabled over HTTPS |
Notifications
- Email for alerts — empty = WordPress admin email. Receives mail for critical events and file changes.
- Log retention — default 30 days. Older logs are cleaned up automatically.
Scanner and file monitoring
Maca Sec → Scanner
Security scan
Click Run scan now for a full check. You will get a security score 0–100 and a list of findings sorted by severity:
- Critical — fix immediately
- Warning — should be addressed
- Info — recommendations
The scanner checks file permissions, suspicious code, admin accounts, 2FA status, PHP version, and configuration, among other things.
Fix — some issues can be fixed with a button directly in the list.
Approve — if you intentionally made a change (for example, your own code in a theme), you can approve the finding so it does not lower the score. Use this only if you know the change is deliberate and safe.
File monitoring
Hash checking of critical files. If a change is detected, the event is logged and email is sent if you have configured alerts.
| File/area | Default |
|---|---|
| wp-config.php | Monitored |
| .htaccess | Monitored |
| Active plugins (main file) | Off |
| All maca Sec files | Off |
If a change is detected without an approved baseline, a warning is shown in wp-admin. You can approve the file change in Logs or Scanner to update the baseline.
CVE scanning (WPScan)
Optional feature that checks installed plugins (and optionally themes) against known vulnerabilities via WPScan API.
- Create a free API token at wpscan.com.
- Enable CVE scanning and paste the token under Scanner.
- Scanning runs in daily batches (scheduled).
Known vulnerabilities are shown under the scanner with CVE numbers and plugin/theme names.
Logs
Maca Sec → Logs
All security events are collected here with filters and pagination (50 per page).
Filter
- Type — e.g. firewall, login, file_monitor, legal_accepted
- Severity — info, warning, critical
- IP address — partial match
- Search message — free text
- Date range — from/to
Actions per row
- Copy — copy IP to clipboard
- Block IP — permanent block (with confirmation; warning if it is your own IP)
- Approve — approve file change directly from the log
Critical events
If there are critical events in the last 24 hours, a red admin notice is shown. Close it with × to hide it until the count increases. You can reset the notice from the logs page.
maca Hub app
Maca Sec → maca Hub app
Requires maca Hub Connector and a connection to the maca Hub app.
Security protection
Main switch for maca Sec. When turned off, no protection modules run on the site. maca Hub can still turn it on or off via API if configured.
Protection cannot be enabled without accepted terms and privacy policy.
Remote actions
- Allow from app — allow security scan and wp-admin login from the maca Hub app.
- Hub whitelist — receive and send whitelisted IPs to all connected Hub sites.
Terms & Policy
Maca Sec → Terms & Policy
Here you read and accept:
- Terms of Use — responsibilities, warranties, and limitations
- Privacy Policy — how data is handled locally and via third-party services
Acceptance is saved with document version, timestamp, and administrator. If the documents are updated, you must accept again — until then, security protection is paused.
What blocked visitors see
Simple error page with HTTP 403:
| Cause | Title | Message |
|---|---|---|
| Country code blacklist | Access denied | Access denied from your country. |
| IP blacklist | Access denied | IP blocked |
| WAF rule | Access denied | Request blocked / Access denied |
| Rate limiting | — | Too many requests |
| Attack shield | — | HTTP 503 (maintenance mode) |
When logging in from a blocked IP: Too many failed attempts. Please try again later.
Security score — what does it mean?
| Score | Meaning |
|---|---|
| 80–100 | Good — the site is well protected |
| 50–79 | OK — there are improvements to make |
| 0–49 | Warning — fix critical issues immediately |
The score is based on the latest scan and is not affected by approved findings.
Tips and troubleshooting
Cannot save settings or get 503
Update to the latest version. The firewall should not block admin saves. Check that your IP is not blocked.
I am locking myself out
- Deactivate the plugin via hosting/FTP (rename the
maca-secfolder). - Remove your IP from the database table
wp_maca_sec_blocked_ips. - Or whitelist your IP first via database/hosting and then activate again.
Country blocking does not work
Requires a country-code header from Cloudflare/server, or outbound HTTP from the server to ip-api.com.
reCAPTCHA/Turnstile is not showing
Check the site key and secret key. The domain in the provider panel must match your site and wp-login.php.
Captcha or firewall blocks legitimate users
Whitelist trusted IPs. Lower rate limiting thresholds. Disable CLI blocking if API clients are affected.
Warning from another security plugin
maca Sec is not always recognized by other plugins — that does not mean it is inactive.
One security plugin at a time
Do not run maca Sec together with Wordfence, iThemes Security, or similar — risk of conflicts and double blocking.
File monitoring alerts after plugin update
Approve the file changes in Scanner or Logs if the update was intentional, so the baseline is updated.
maca Hub cannot enable protection
First accept the terms and policy under Terms & Policy in wp-admin.
Uninstall
When removed via the WordPress admin, cleanup runs automatically: settings, logs, IP lists, 2FA metadata, and scheduled jobs are deleted.
System requirements
| Requirement | Version |
|---|---|
| WordPress | 6.0 or later |
| PHP | 7.4+ (8.1+ recommended) |
| Database | MySQL or MariaDB |
Related documents
- Terms & Policy — in wp-admin under maca Sec
- maca.se — https://maca.se/
Ask a Genius