We study secure communications in cell-free massive multiple-input multiple-output (CF-mMIMO) systems with multi-antenna access points (APs) and protective partial zero-forcing (PPZF) precoding. In particular, we consider an active eavesdropping attack, where an eavesdropper contaminates the uplink channel estimation phase by sending an identical pilot sequence with a legitimate user of interest. We formulate an optimization problem for maximizing the received signal-to-noise ratio (SINR) at the legitimate user, subject to a maximum allowable SINR at the eavesdropper and maximum transmit power at each AP, while guaranteeing specific SINR requirements on other legitimate users. The optimization problem is solved using a path-following algorithm. We also propose a large-scale-based greedy AP selection scheme to improve the secrecy spectral efficiency (SSE). Finally, we propose a simple method for identifying the presence of an eavesdropper within the system. Our findings show that PPZF can substantially outperform the conventional maximum-ratio transmission (MRT) scheme by providing around 2-fold improvement in the SSE compared to the MRT scheme. More importantly, for PPZF precoding scheme, our proposed AP selection can achieve a remarkable SSE gain of up to 220%, while our power optimization approach can provide an additional gain of up to 55% compared with a CF-mMIMO system with equal power allocation.