My Jetpack: Protect Card Shows "Partial" Scan Status when Nothing has been Scanned

[bobmatyas]

Impacted plugin

Protect

Quick summary

In "My Jetpack", by default the Scan status says the protection level is "Partial" when Jetpack is first installed:

However, nothing has been scanned. When you mouseover the info icon, it shows this text:

I don't believe anything has actually been checked at this point

Steps to reproduce

1. Install Jetpack on a test site
2. Connect to WordPress.com
3. Go to My Jetpack and see the misleading status

Site owner impact

Between 20% and 60% of the total website/platform users

Severity

Minor

What other impact(s) does this issue have?

No revenue impact

If a workaround is available, please outline it here.

No response

Platform (Simple and/or Atomic)

Self-hosted

[bobmatyas]

@Automattic/jetpack-martech Is this something you all handle?

[github-actions]

OpenAI suggested the following labels for this issue:

• [Feature Group] Support: The issue pertains to user support, as it addresses a misleading status displayed within the Jetpack plugin that may cause confusion among users.
• [Feature] Protect: The issue directly relates to the Protect feature of Jetpack, as it involves the scan status displayed by this security feature.
• [Feature] Scan: The misleading status of 'Partial' scan when nothing has been scanned relates specifically to the scanning functionality of the Protect feature in Jetpack.

[robertsreberski]

Hey @elliottprogrammer , you've worked on it at some point, do you have an idea whether this is a correct behaviour?

We've just talked with @IanRamosC on Roadmap call about it, and concluded that it is an expected use case, cause Protect does not scan the website but rather compare plugin versions and code towards the database (what matches the description in the tooltip).

Maybe what we would need here is to adjust the wording to avoid any confusion.

[bobmatyas]

@robertsreberski Thanks for looking at this.

The tooltip shows when the Protect plugin isn't installed, though, and therefore (as far as I know) no plugins have been compared against our vulnerability database.