diff --git a/src/main/java/company/specialsource/config/WebMvcConfig.java b/src/main/java/company/specialsource/config/WebMvcConfig.java
index 123bdaf..f9d0a2f 100644
--- a/src/main/java/company/specialsource/config/WebMvcConfig.java
+++ b/src/main/java/company/specialsource/config/WebMvcConfig.java
@@ -1,20 +1,28 @@
 package company.specialsource.config;
 
-import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.web.SecurityFilterChain;
 
 @Configuration
-@RequiredArgsConstructor
-public class WebMvcConfig implements WebMvcConfigurer {
+@EnableWebSecurity
+public class WebMvcConfig {
 
-    private final VisitorInterceptor visitorInterceptor;
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+            // 1. 🟢 외부 매크로의 POST 요청이 통과할 수 있도록 CSRF 보호 대상에서 업로드 API를 제외합니다.
+            .csrf(csrf -> csrf
+                .ignoringRequestMatchers("/api/sync/upload")
+            )
+            // 2. 🟢 로그인이나 별도의 인증 토큰 없이도 접근할 수 있도록 허용합니다.
+            .authorizeHttpRequests(auth -> auth
+                .requestMatchers("/api/sync/upload").permitAll()
+                .anyRequest().authenticated()
+            );
 
-    @Override
-    public void addInterceptors(InterceptorRegistry registry) {
-        registry.addInterceptor(visitorInterceptor)
-                .addPathPatterns("/api/**") // 🟢 모든 API 주소로 들어오는 길목을 차단하여 감시
-                .excludePathPatterns("/api/analytics/**", "/static/**", "/favicon.ico"); // 통계 조회 API 자체는 중복 카운팅 차단
+        return http.build();
     }
 }
\ No newline at end of file