Protect Dashboard: Add a feature-flagged module that takes over the Protect page by enejb · Pull Request #53182 · Automattic/jetpack

enejb · 2026-10-05T18:31:14Z

Fixes JETPACK-2930

Part of JETPACK-2879, JETPACK-2884

Contributes to JETPACK-2872

Proposed changes

Add a jetpack-protect-dashboard feature flag, off by default. While it is off, it removes the new protect-dashboard module from jetpack_get_available_modules, so the module can't be activated, doesn't load, and isn't listed.
Add a protect-dashboard module. Its slug isn't protect because that is already Brute Force protection. When active, it registers a Protect sidebar item on admin.php?page=jetpack-protect, the same address the Jetpack Protect plugin uses, so Protect's URL never changes.
When the Jetpack Protect plugin is also active, the module takes the page over instead of adding a second item. The plugin registers its item on _admin_menu; at admin_menu priority 999 (before Admin_Menu registers items at 1000), the module removes that item and the plugin's load- hooks for the page, then adds its own. The sidebar always shows one Protect item. The plugin's admin-bar link, threat-count badge and My Jetpack's manage link already point at page=jetpack-protect, so they follow along.
Put the dashboard in the shared packages/protect package (automattic/jetpack-protect, added in Protect: Rename plugin Composer package and add packages/protect #53298), so the Jetpack plugin's protect-dashboard module and, later, the Jetpack Protect plugin can share it. The Protect plugin doesn't use it yet; that's a follow-up.
The package holds the wp-build route (routes/dashboard, page id jetpack-protect-dashboard), the Automattic\Jetpack\Protect\Dashboard class that adds the menu item and loads the package's own build/, and its tests. For now the page only shows a "Protect" title.
The Jetpack plugin keeps only the feature flag and modules/protect-dashboard.php, which calls Dashboard::init() with the module name so the menu item is tied to the module.
My Jetpack: the Protect feature's delivery.jetpack now follows the flag, by checking whether the protect-dashboard module is on offer. With the flag on, the Features-tab Protect card treats Protect as part of Jetpack and switches the protect-dashboard module, instead of offering to install the Jetpack Protect plugin.
My Jetpack: Protect's manage link points at page=jetpack-protect once the dashboard has loaded. Dashboard::init() fires jetpack_protect_dashboard_initialized for this, the same way Backup signals its page.
The Jetpack plugin now requires the package. The pnpm-lock.yaml change is just the package's importer entry, which now has dependencies.

Related product discussion/links

A trimmed-down starting point taken from the exploration spike in Jetpack: Explore a Protect dashboard module #52777, without its content.
My Jetpack: Configure beside the switch, and keep Brute Force Protection off the Protect card #52829 already mapped My Jetpack's Protect feature to the protect-dashboard module.
Keep the flag off on sites using the Jetpack Protect plugin: the new page replaces that plugin's dashboard, and it's blank for now.

Does this pull request change what data or activity we track or use?

No.

Testing instructions

Build and sync the Jetpack plugin to a connected test site, e.g. a Jurassic Ninja site with JETPACK_AUTOLOAD_DEV set. Install and activate the Jetpack Protect plugin too.
Flag off (default):
- wp jetpack module activate protect-dashboard should fail with "protect-dashboard is not a valid module".
- The sidebar should show one Protect item, and admin.php?page=jetpack-protect should render the Jetpack Protect plugin's page.
- My Jetpack → Features: the Protect card should still offer the Jetpack Protect plugin.
Turn the flag on, either from the Jurassic Ninja feature-flag UI or with wp companion feature-flag enable jetpack-protect-dashboard.
Activate the module with wp jetpack module activate protect-dashboard, or with the Protect switch in My Jetpack → Features.
Flag on, module on:
- There should still be exactly one Protect item, linking to admin.php?page=jetpack-protect.
- The page should be the new blank wp-build page titled "Protect", and none of the Jetpack Protect plugin's scripts should load on it.
Deactivate the Jetpack Protect plugin. The Protect item and the new page should stay.
Reactivate the plugin, then deactivate the module. The item should point back to the plugin's own page.
Turn the flag off again with wp companion feature-flag disable jetpack-protect-dashboard. The plugin's page should return even though the module is still stored as active.

github-actions · 2026-10-05T18:32:39Z

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (Jetpack or WordPress.com Site Helper), and enable the add/protect-dashboard-module branch.
To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack add/protect-dashboard-module

bin/jetpack-downloader test jetpack-mu-wpcom-plugin add/protect-dashboard-module

Interested in more tips and information?

In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
Read more about our development workflow here: PCYsg-eg0-p2
Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

github-actions · 2026-10-05T18:32:58Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
✅ Add a "[Status]" label (In Progress, Needs Review, ...).
✅ Add testing instructions.
✅ Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

Follow this PR Review Process:

Ensure all required checks appearing at the bottom of this PR are passing.
Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
You can use GitHub's Reviewers functionality to request a review.
When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

Jetpack plugin:

No scheduled milestone found for this plugin.

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

Inspect plugin:

No scheduled milestone found for this plugin.

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

jp-launch-control · 2026-10-05T18:49:18Z

Code Coverage Summary

Coverage changed in 3 files.

File	Coverage	Δ%	Δ Uncovered
projects/plugins/jetpack/load-jetpack.php	0/60 (0.00%)	0.00%	1 ❤️‍🩹
projects/plugins/jetpack/modules/module-headings.php	1120/1156 (96.89%)	-0.03%	1 ❤️‍🩹
projects/packages/my-jetpack/src/products/class-protect.php	184/202 (91.09%)	0.50%	-1 💚

3 files are newly checked for coverage.

File	Coverage
projects/plugins/jetpack/modules/protect-dashboard.php	0/4 (0.00%) 💔
projects/plugins/jetpack/_inc/lib/class-jetpack-protect-dashboard-feature-flags.php	3/15 (20.00%) 💔
projects/packages/protect/src/class-dashboard.php	45/67 (67.16%) 💚

Full summary · PHP report · JS report

_{Coverage check overridden by

Covered by non-unit tests
Use to ignore the Code coverage requirement check when E2Es or other non-unit tests cover the code
.}

kraftbj · 2026-10-06T16:04:55Z

 				'delivery'         => array(
-					'jetpack'     => false,
+					// The flag is registered by the Jetpack plugin, which owns the `protect-dashboard` module.
+					'jetpack'     => Feature_Flags::is_enabled( 'jetpack-protect-dashboard' ),


Pushed two commits: one points My Jetpack's Protect manage link at the new page when the module is active without the standalone plugin (it was going to protect-details or Jetpack Cloud), the other adds tests for the flag gate and the menu takeover.

One thing I left alone. With the flag on, the Protect plugin active and the module off, the Features card reads Off while Protect is running. resolveFeatureState() takes the module branch as soon as in_jetpack is true and never looks at plugin_status. The switch then only flips the module, so turning it on swaps the plugin's working dashboard for the blank page.

I tried counting an active plugin as "on" in that branch (the plugin branch below already does), but it applies to every hybrid feature, not just Protect, and it leaves the card saying active while its own switch says off. Bulk on/off gets confused the same way. So I backed it out.

What should that switch mean when both the plugin and the module can deliver the feature? Fine to leave for the PR that fills in the page, but I think it needs an answer before the flag defaults on.

enejb · 2026-10-06T17:09:16Z

+					 *
+					 * @param bool $in_jetpack Whether the Jetpack plugin delivers Protect. Default false.
+					 */
+					'jetpack'     => (bool) apply_filters( 'jetpack_my_jetpack_protect_in_jetpack', false ),


This used to be just Feature_Flags::is_enabled( self::DASHBOARD ); Do we want to introduce another filter here?

no, taking that out.

jboland88 · 2026-10-06T22:03:36Z

Any reason not to go with packages/protect over packages/protect-ui?

Later PRs like #53190 and #53195 start bringing in supporting backend logic and rest routes that go outside the "UI Only" scope implied by the name. I think the package handling the whole of Protect's functionality (UX, API, Jetpack Backend) is correct - but the UI name seems misleading in that case.

enejb · 2026-10-06T22:15:08Z

Any reason not to go with packages/protect over packages/protect-ui?

yeah I wish I could have went with jetpack-protect but since http://github.com/Automattic/jetpack-protect already exist as a repo, so doing that wasn't possible.

I am open to naming suggestions though.

jboland88 · 2026-10-07T13:48:40Z

yeah I wish I could have went with jetpack-protect but since http://github.com/Automattic/jetpack-protect already exist as a repo, so doing that wasn't possible.

Hmm. I was able to set it up:
#53298

This gives us a "Protect" package with the slug jetpack-protect

This does some renaming for the jetapck-protect plugin to use the -plugin suffix, which matches its existing mirror repo at Automattic/jetpack-protect-plugin

Automattic/jetpack-protect was not actually taken yet. It was just redirected by GH to the closest match. I added the new repo for Automattic/jetpack-protect and set it up as a mirror: https://github.com/Automattic/jetpack-protect

This same rename pattern was used when the Search plugin introduced a corresponding package in #21502. Though, fortunately for us, the repo names are already correct and don't need to be changed for protect.

… Protect page

…pack Protect plugin

…in's description

With the protect-dashboard module active and no standalone plugin, the link went to protect-details or Jetpack Cloud instead of the Protect page.

My Jetpack no longer depends on the feature flags package, so the Jetpack plugin now reports the flag through jetpack_my_jetpack_protect_in_jetpack.

Drops the filter added earlier. The flag already removes protect-dashboard from the available modules, so My Jetpack can ask whether the module exists.

…ckage class

…and flag tests

…t of Jetpack on Simple

kraftbj

Should this page opt out of JITMs the way Activity Log does (jetpack_display_jitms_on_screen)? There's no #jp-admin-notices here, so a fetched JITM would count a view without showing.

enejb · 2026-10-07T17:18:02Z

Should this page opt out of JITMs the way Activity Log does (jetpack_display_jitms_on_screen)?

@kraftbj lets fix this in the follow up? unless there are somethings here that are not ready.

enejb added the [Status] In Progress label Oct 5, 2026

enejb self-assigned this Oct 5, 2026

github-actions Bot added [Feature] Protect Dashboard [Plugin] Jetpack Issues about the Jetpack plugin. https://wordpress.org/plugins/jetpack/ labels Oct 5, 2026

enejb changed the title ~~Protect Dashboard: Add a feature-flagged module with a blank Protect page~~ Protect Dashboard: Add a feature-flagged module that takes over the Protect page Oct 5, 2026

github-actions Bot added the [Package] My Jetpack label Oct 5, 2026

enejb marked this pull request as ready for review October 5, 2026 19:09

kraftbj reviewed Oct 6, 2026

View reviewed changes

github-actions Bot added the [Tests] Includes Tests label Oct 6, 2026

kraftbj added this pull request to stack #53235 October 6, 2026 16:22

enejb commented Oct 6, 2026

View reviewed changes

kraftbj added the Covered by non-unit tests Use to ignore the Code coverage requirement check when E2Es or other non-unit tests cover the code label Oct 6, 2026

kraftbj previously approved these changes Oct 6, 2026

View reviewed changes

enejb dismissed kraftbj’s stale review via 095807d October 6, 2026 21:08

github-actions Bot added Docs [Package] Protect [Package] Protect Ui labels Oct 6, 2026

jboland88 mentioned this pull request Oct 7, 2026

Protect: Rename plugin Composer package and add packages/protect #53298

Merged

enejb and others added 9 commits October 7, 2026 08:28

Protect Dashboard: Add a feature-flagged module with a blank wp-build…

3f12bc1

… Protect page

Protect Dashboard: Take over the Protect page and switch from the Jet…

978d272

…pack Protect plugin

Protect Dashboard: Name the module Protect and reuse the Protect plug…

6f95144

…in's description

Protect Dashboard: Pass Page its required children

eb43806

My Jetpack: Point Protect's manage link at the dashboard module

f48448d

With the protect-dashboard module active and no standalone plugin, the link went to protect-details or Jetpack Cloud instead of the Protect page.

Protect Dashboard: Test the flag gate and the menu takeover

bb9e7a9

Protect Dashboard: Capture render output with output buffering

6ecbf0a

My Jetpack: Read Protect's Jetpack delivery from a filter

046758b

My Jetpack no longer depends on the feature flags package, so the Jetpack plugin now reports the flag through jetpack_my_jetpack_protect_in_jetpack.

My Jetpack: Read Protect's Jetpack delivery from the module list

a828e48

Drops the filter added earlier. The flag already removes protect-dashboard from the available modules, so My Jetpack can ask whether the module exists.

enejb force-pushed the add/protect-dashboard-module branch from a170ed7 to 65fe55c Compare October 7, 2026 15:33

github-actions Bot added the [Plugin] Inspect label Oct 7, 2026

Protect Dashboard: Move the dashboard into the Protect package

f45f123

enejb force-pushed the add/protect-dashboard-module branch from 65fe55c to f45f123 Compare October 7, 2026 15:41

enejb and others added 4 commits October 7, 2026 08:48

Protect: Use the Automattic\Jetpack\Protect namespace and drop the Pa…

72ef65d

…ckage class

Protect Dashboard: Simplify the manage-URL check, module offer test, …

c13bfb9

…and flag tests

Protect Dashboard: Test the wp-build loading path and keep Protect ou…

33e960c

…t of Jetpack on Simple

Protect Dashboard: Test the page check that scopes wp-build loading

fad2069

kraftbj reviewed Oct 7, 2026

View reviewed changes

enejb merged commit a2689e7 into trunk Oct 7, 2026
118 checks passed

enejb deleted the add/protect-dashboard-module branch October 7, 2026 17:48

github-actions Bot added [Status] UI Changes Add this to PRs that change the UI so documentation can be updated. and removed [Status] In Progress labels Oct 7, 2026

kraftbj mentioned this pull request Oct 7, 2026

Jetpack: Add a failing test for the security menu entries across the site matrix #53322

Open

Navigation Menu

Repository navigation

Protect Dashboard: Add a feature-flagged module that takes over the Protect page - #53182

Protect Dashboard: Add a feature-flagged module that takes over the Protect page#53182
enejb merged 14 commits into
trunkfrom
add/protect-dashboard-module

enejb commented Oct 5, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

jp-launch-control Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

kraftbj Oct 6, 2026

Uh oh!

enejb Oct 6, 2026

Uh oh!

kraftbj Oct 6, 2026

Uh oh!

jboland88 commented Oct 6, 2026

Uh oh!

enejb commented Oct 6, 2026

Uh oh!

jboland88 commented Oct 7, 2026 •

edited

Loading

Uh oh!

kraftbj left a comment

Uh oh!

enejb commented Oct 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

enejb commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Related product discussion/links

Does this pull request change what data or activity we track or use?

Testing instructions

Uh oh!

github-actions Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jp-launch-control Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Summary

Uh oh!

kraftbj Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

enejb Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

kraftbj Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

jboland88 commented Oct 6, 2026

Uh oh!

enejb commented Oct 6, 2026

Uh oh!

jboland88 commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kraftbj left a comment

Choose a reason for hiding this comment

Uh oh!

enejb commented Oct 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

enejb commented Oct 5, 2026 •

edited

Loading

github-actions Bot commented Oct 5, 2026 •

edited

Loading

github-actions Bot commented Oct 5, 2026 •

edited

Loading

jp-launch-control Bot commented Oct 5, 2026 •

edited

Loading

jboland88 commented Oct 7, 2026 •

edited

Loading