MalCare auto-blocks IPs after a small number of failed authentication attempts. That can hit Cowork Bridge on the first /wp-setup if anything goes wrong on the initial pairing.
Whitelist your Cowork desktop IP
- MalCare dashboard → Settings → Login Protection → Whitelist.
- Add your Cowork desktop’s IP address.
If you don’t know your IP, search “what is my IP” — your home or office router’s public IP is what MalCare sees.
Or temporarily relax REST API restrictions
If you’d rather not pin an IP (mobile setups, VPNs), temporarily relax MalCare’s REST API restrictions just while installing Cowork Bridge, then tighten back up.
What about the malware scanner?
MalCare’s scanner is fine — it doesn’t touch Cowork Bridge’s mu-plugin files because mu-plugins live in a different directory than the normal plugins folder.