Account Protection: Do not activate by default on new connections

projects/plugins/jetpack/changelog/update-account-protection-no-auto-activate

@@ -0,0 +1,4 @@
+Significance: minor
+Type: enhancement
+
+Account Protection: Do not activate the module by default on new connections. Existing sites keep their current setting.

projects/plugins/jetpack/modules/account-protection.php

@@ -6,7 +6,7 @@
  * First Introduced: 14.5
  * Requires Connection: Yes
  * Requires User Connection: No
- * Auto Activate: Yes
+ * Auto Activate: No
  * Module Tags: Account Protection
  * Feature: Security
  *

projects/plugins/jetpack/tests/php/general/Jetpack_Account_Protection_Auto_Activate_Test.php

@@ -0,0 +1,37 @@
+<?php
+/**
+ * Tests that the account-protection module is not auto-activated.
+ *
+ * Both activation paths read Jetpack::get_default_modules(): a new connection
+ * activates every default module, and an upgrade activates the default modules
+ * introduced since the previous version. Neither path deactivates modules, so
+ * existing sites keep whatever state they already have.
+ *
+ * @package automattic/jetpack
+ */
+
+use PHPUnit\Framework\Attributes\CoversClass;
+
+/**
+ * Class Jetpack_Account_Protection_Auto_Activate_Test
+ *
+ * @covers \Jetpack
+ */
+#[CoversClass( Jetpack::class )]
+class Jetpack_Account_Protection_Auto_Activate_Test extends \WP_UnitTestCase {
+	use \Automattic\Jetpack\PHPUnit\WP_UnitTestCase_Fix;
+
+	/**
+	 * A new connection activates all default modules; account-protection must not be one of them.
+	 */
+	public function test_account_protection_is_not_activated_on_new_connection() {
+		$this->assertNotContains( 'account-protection', Jetpack::get_default_modules() );
+	}
+
+	/**
+	 * An upgrade from a version before the module was introduced (14.5) must not activate it.
+	 */
+	public function test_account_protection_is_not_activated_on_upgrade_from_before_14_5() {
+		$this->assertNotContains( 'account-protection', Jetpack::get_default_modules( '14.4', JETPACK__VERSION ) );
+	}
+}

projects/plugins/protect/changelog/update-account-protection-no-auto-activate

@@ -0,0 +1,4 @@
+Significance: minor
+Type: changed
+
+Account Protection: Do not activate the module when Protect is activated. Existing sites keep their current setting.

projects/plugins/protect/src/class-jetpack-protect.php

@@ -304,7 +304,6 @@ public static function do_plugin_activation_activities() {
 	 */
 	public static function activate_modules() {
 		delete_option( self::JETPACK_PROTECT_ACTIVATION_OPTION );
-		( new Modules() )->activate( self::JETPACK_ACCOUNT_PROTECTION_MODULE_SLUG, false, false );
 		( new Modules() )->activate( self::JETPACK_WAF_MODULE_SLUG, false, false );
 		( new Modules() )->activate( self::JETPACK_BRUTE_FORCE_PROTECTION_MODULE_SLUG, false, false );
 	}