WordPress powers millions of websites — and therefore also attracts attackers. Brute force attacks on logins, malicious bots, SQL injection, known CVE vulnerabilities, and unauthorized file changes are everyday threats that can take your site offline or compromise data.
maca Sec is a security plugin developed by maca Development. It brings together a firewall (WAF), login protection, two-factor authentication, hardening, scanning, file monitoring, and logging in one place. All features are included from the start — no premium tiers, no locked modules.
The plugin is open source (GPL), runs on your own server, and is built for Swedish and international WordPress sites. The interface is shown in Swedish when WordPress is installed in Swedish, and in English for all other language settings. The user guide and legal documents are also available in both languages.
What’s new in the latest version
Collective threat intelligence
maca Sec can anonymously report new attacks to the maca Hub network and receive block rules that have already stopped attacks on hundreds of other sites. Attackers who try again will meet protection faster.
File system guard 2.0
Deep scanning of uploads and themes for new PHP files, web shell signatures, and suspicious code — eval, Base64, gzinflate, and more.
Security score
Holistic score 0–100 with a checklist on the dashboard: PHP version, HTTPS, 2FA, WAF, CVE status, and updates — all at a glance.
Live Attack Map
Real-time data on attacks per minute, countries, attack types, and latest exploits — shown in the maca Hub app when the site is connected.
AI bot protection
Per-bot policy (Allow / Block / Limit) for GPTBot, ClaudeBot, Bytespider, PerplexityBot, and Amazonbot.
Smart rate limiting
Behavior weighting beyond plain IP blocking — burst, URL patterns, method, cookies, and referer — for fewer false positives and better bot protection.
Why maca Sec?
Everything included
Firewall, 2FA, captcha, CVE scanning, honeypot traps, file monitoring, supply chain protection, and security scanner — with no paywall.
Built for WordPress
Clear dashboard with security score, logs, checklist, and step-by-step guide directly in wp-admin.
Protection early
The firewall analyzes traffic before WordPress has a chance to process dangerous requests. Attacks are stopped at the door.
You stay in control
Whitelist your IP, choose rules, block countries, and get email alerts for critical events. Logged-in administrators in wp-admin bypass the firewall so you can work as usual.
Open and transparent
No cloud service required. maca Sec logs locally, can be cleanly uninstalled, and telemetry can be disabled completely.
Swedish and English
The plugin, the guide, and the legal documents are available in both languages — adapted to your WordPress installation.
Features
Firewall (WAF)
Stops SQL injection, XSS, path traversal, and dangerous file uploads. Block IP addresses, filter by country code, manage AI bots, and whitelist trusted addresses.
Rate limiting and Attack Shield
Limits requests per IP across the whole site, wp-login, wp-admin, XML-RPC, and REST API. Smart rate limiting weighs behavioral signals. Attack Shield temporarily activates maintenance mode (HTTP 503) under extreme traffic.
Login protection and honeypot traps
Brute force protection, fake login-/XML-RPC-/REST paths that catch scanners, captcha (mathematical, reCAPTCHA, or Cloudflare Turnstile), strong passwords, session management, and email alerts.
Two-factor authentication (2FA)
TOTP with Google Authenticator, Authy, or 1Password. QR code and recovery codes per user.
WordPress hardening and HTTP headers
Close common security holes and set security headers (X-Frame-Options, HSTS, CSP, etc.).
Security scanner, CVE table and security score
Score 0–100 with checklist. CVE table per installed plugin with risk level and update recommendations (WPScan). Email alerts for new high-risk vulnerabilities.
File monitoring and file system guard 2.0
Monitors critical files and searches for new PHP files, web shell signatures, and suspicious code in uploads and themes.
Supply chain protection and behavioral analysis
Monitors plugin integrity, developer changes, and WordPress.org checksums. Risk score 0–100 for unusual REST and POST behavior.
Security log
All events are collected in one place. Filter, search, and block suspicious IP addresses directly from the log.
maca Hub — under development
maca Hub is an iOS app that connects your WordPress sites with maca plugins. Through maca Sec, you can get:
- Security status and reports on mobile
- Collective threat intelligence — shared attack patterns from the entire network
- Live Attack Map with attacks per minute, countries, and attack types
- Remote control and whitelist sync
maca Hub is under active development. The app is currently available only for iOS. We are looking for testers who want to try the integration between maca Sec and maca Hub — contact us via the contact form if you want to join.
maca Hub is not required — maca Sec works fully on its own.
How it works
- Install the plugin in WordPress (requires WordPress 6.0+ and PHP 7.4+).
- Accept the terms of use and privacy policy upon first activation.
- Open the dashboard under maca Sec in the side menu.
- Run a security scan and address critical issues.
- Whitelist your IP before enabling stricter rules.
- Enable 2FA on your administrator account.
- Review the logs regularly — or let email alerts notify you of serious events.
Who is it for?
maca Sec is suitable for anyone running a business website, blog, or online store in WordPress and who wants complete security without per-feature monthly costs — whether you prefer Swedish or English in the admin area.
Technical requirements
| Requirement | Version |
|---|---|
| WordPress | 6.0 or later |
| PHP | 7.4+ (8.1+ recommended) |
| Database | MySQL or MariaDB |
| Language | Swedish and English |
Your WordPress site deserves protection that doesn’t cost extra for every new feature. maca Sec gives you that — free, open, and ready to install.
Ask a Genius