MalCare auto-blocks IPs after a small number of failed authentication attempts. That can hit the WordPress for Cowork plugin on the first connection if anything goes wrong while it sets up.
Whitelist Anthropic’s outbound range
- MalCare dashboard → Settings → Login Protection → Whitelist.
- Add
160.79.104.0/21, Anthropic’s published outbound range. Claude connects from Anthropic’s servers, not from your computer.
Your own home or office IP is not what MalCare sees when Claude connects, so adding it does nothing.
Or temporarily relax REST API restrictions
If you’d rather not pin an IP (mobile setups, VPNs), temporarily relax MalCare’s REST API restrictions just while installing the WordPress for Cowork plugin, then tighten back up.
What about the malware scanner?
MalCare’s scanner is fine — it doesn’t touch the WordPress for Cowork plugin’s mu-plugin files because mu-plugins live in a different directory than the normal plugins folder.