MalCare auto-blocks IPs after a small number of failed authentication attempts. That can hit the WordPress for Cowork plugin on the first connection if anything goes wrong while it sets up.
Whitelist your Cowork desktop IP
- MalCare dashboard → Settings → Login Protection → Whitelist.
- Add your Cowork desktop’s IP address.
If you don’t know your IP, search “what is my IP” — your home or office router’s public IP is what MalCare sees.
Or temporarily relax REST API restrictions
If you’d rather not pin an IP (mobile setups, VPNs), temporarily relax MalCare’s REST API restrictions just while installing the WordPress for Cowork plugin, then tighten back up.
What about the malware scanner?
MalCare’s scanner is fine — it doesn’t touch the WordPress for Cowork plugin’s mu-plugin files because mu-plugins live in a different directory than the normal plugins folder.