feat(agency): WP-CLI command + wp-config constants API (2.5.0)

admin/partials/settings-page.php

@@ -500,11 +500,24 @@
                             <label for="webdecoy_monitor_mode"><?php esc_html_e('Monitor mode', 'webdecoy'); ?></label>
                         </th>
                         <td>
+                            <?php $wd_forced_mode = WebDecoy_Runtime_Config::forced_monitor_mode(); ?>
                             <label>
                                 <input type="checkbox" id="webdecoy_monitor_mode" name="webdecoy_options[monitor_mode]"
-                                       value="1" <?php checked(!array_key_exists('monitor_mode', $options) || !empty($options['monitor_mode'])); ?> />
+                                       value="1" <?php checked($wd_forced_mode !== null ? $wd_forced_mode : (!array_key_exists('monitor_mode', $options) || !empty($options['monitor_mode']))); ?>
+                                       <?php disabled($wd_forced_mode !== null); ?> />
                                 <?php esc_html_e('Watch only — detect and log everything, block nothing', 'webdecoy'); ?>
                             </label>
+                            <?php if ($wd_forced_mode !== null) : ?>
+                            <p class="description">
+                                <?php
+                                printf(
+                                    /* translators: %s: the PHP constant, already formatted as code */
+                                    esc_html__('Locked by %s in wp-config.php. Remove the constant to change the mode here.', 'webdecoy'),
+                                    '<code>WEBDECOY_DEFAULT_MODE</code>'
+                                );
+                                ?>
+                            </p>
+                            <?php endif; ?>
                             <p class="description">
                                 <?php esc_html_e('On by default. Every setting below still decides what WOULD happen, and the Detections page shows it, but no visitor is ever blocked, throttled or shown a 403. Turn this off once you have looked at what enforcement would have done.', 'webdecoy'); ?>
                             </p>

changelog.txt

@@ -1,5 +1,10 @@
 *** WebDecoy Bot Detection Changelog ***
 
+= 2.5.0 - 2026-08-17 =
+* Added: a wp webdecoy WP-CLI command for agency deploy scripts. wp webdecoy status reports mode, cloud connection, detection counts, active blocks, and retention. wp webdecoy config list/get/set covers every safe setting, including config set mode monitor|block. wp webdecoy allowlist add|remove|list manages the IP allowlist (whitelist your agency VPN across every client site in one loop). wp webdecoy logs flush clears the local detection log.
+* Added: wp-config.php constants for code-locked configuration. WEBDECOY_DEFAULT_MODE ('monitor' or 'block') forces the mode, overrides the stored setting, and locks the admin toggle; a settings save while forced can no longer silently drift the stored mode. WEBDECOY_HIDE_ADMIN_UI hides the WebDecoy menu, dashboard widget, and admin notices for white-label installs (the plugin stays visible in the Plugins list on purpose). WEBDECOY_MAX_LOG_RETENTION overrides the 30-day detection retention (1 to 3650 days).
+* Changed: an unrecognized WEBDECOY_DEFAULT_MODE value is ignored rather than guessed. Forcing 'block' on a typo would enforce on a site that asked to watch; forcing 'monitor' would disarm one that asked to enforce.
+
 = 2.4.1 - 2026-08-17 =
 * Fixed: cloud features switch on immediately after one-click connect. The connection itself succeeded, but the premium status stayed off until a later background revalidation, so the JS verification token and cloud reporting were silently inactive at the exact moment you had just connected.
 * Fixed: the dashboard widget's "Learn more" link landed on the Protection tab instead of the WebDecoy Cloud tab.

includes/class-webdecoy-activator.php

@@ -293,10 +293,14 @@ public static function uninstall(): void
         gmdate('Y-m-d H:i:s', strtotime('-1 hour'))
     ));
 
-    // Clean up old detections (keep 30 days)
+    // Clean up old detections. 30 days by default; WEBDECOY_MAX_LOG_RETENTION
+    // in wp-config.php overrides it (agencies keep client databases light).
+    $retention_days = class_exists('WebDecoy_Runtime_Config')
+        ? WebDecoy_Runtime_Config::log_retention_days()
+        : 30;
     $wpdb->query($wpdb->prepare(
         "DELETE FROM {$wpdb->prefix}webdecoy_detections WHERE created_at < %s",
-        gmdate('Y-m-d H:i:s', strtotime('-30 days'))
+        gmdate('Y-m-d H:i:s', strtotime("-{$retention_days} days"))
     ));
 
     // Clean up old checkout attempts (keep 7 days)