feat: cloud calls default to in.webdecoy.com, the fronted ingest address (#83)

Every server-to-server call the plugin makes (detections, page-serve,
violations, IP enrichment, actor feed and intel, entitlements, the
bundled SDK client) moves behind Cloudflare fronting (app repo #833).
These connections carry no fingerprint telemetry, so the proxy costs
nothing and buys DDoS absorption in front of ingest. Sites that set a
custom API URL are unaffected. 2.8.0.

Author: cport1

changelog.txt

@@ -1,5 +1,8 @@
 *** WebDecoy Bot Detection Changelog ***
 
+= 2.8.0 - 2026-08-28 =
+* Changed: the plugin's cloud calls now go to in.webdecoy.com, WebDecoy's DDoS-protected ingest address. Same service, sturdier front door. If your firewall allows outbound requests by hostname, allow in.webdecoy.com. Sites that set a custom API URL are unaffected.
+
 = 2.7.1 - 2026-08-18 =
 * Removed: the canary trip email introduced in 2.7.0. The canary link sits on every public page, so busy sites would receive an email every hour, forever. Detections belong on the Detections page, not in your inbox. Everything else from 2.7.0 stays: the canary URL in settings, the trip-it-yourself prompt, and the Detections page recording every hit.
 

includes/class-webdecoy-actor-feed.php

@@ -57,7 +57,7 @@ class WebDecoy_Actor_Feed
     public const CRON_HOOK = 'webdecoy_sync_actor_feed';
 
     /** Shared actor feed endpoint (Bearer API key; same auth as entitlements). */
-    private const FEED_ENDPOINT = 'https://ingest.webdecoy.com/api/v1/sdk/actor-feed';
+    private const FEED_ENDPOINT = 'https://in.webdecoy.com/api/v1/sdk/actor-feed';
 
     /** Option persisting the delta cursor (`since`) between syncs. */
     private const CURSOR_OPTION = 'webdecoy_actor_feed_cursor';

includes/class-webdecoy-actor-intel.php

@@ -32,7 +32,7 @@
 class WebDecoy_Actor_Intel
 {
     /** Batched intel endpoint (Bearer API key). */
-    private const ENDPOINT = 'https://ingest.webdecoy.com/api/v1/sdk/detections/intel';
+    private const ENDPOINT = 'https://in.webdecoy.com/api/v1/sdk/detections/intel';
 
     /** Per-IP transient cache prefix. */
     private const CACHE_PREFIX = 'webdecoy_intel_';

includes/class-webdecoy-cloud-connect.php

@@ -45,7 +45,7 @@ class WebDecoy_Cloud_Connect
      * {@see WebDecoy_Violation_Reporter} authenticates the violations batch:
      * an `Authorization: Bearer <api_key>` header against the ingest service.
      */
-    private const ENTITLEMENTS_ENDPOINT = 'https://ingest.webdecoy.com/api/v1/sdk/entitlements';
+    private const ENTITLEMENTS_ENDPOINT = 'https://in.webdecoy.com/api/v1/sdk/entitlements';
 
     /** Where the generic "Upgrade" link points once connected. */
     private const BILLING_URL = 'https://app.webdecoy.com/billing';

includes/class-webdecoy-ip-enrichment.php

@@ -24,7 +24,7 @@
  */
 class WebDecoy_IP_Enrichment
 {
-    private const ENDPOINT_BASE = 'https://ingest.webdecoy.com/api/v1/sdk/ip/';
+    private const ENDPOINT_BASE = 'https://in.webdecoy.com/api/v1/sdk/ip/';
 
     /** Cache TTL — 1 hour, matching node's ttlMs default. */
     private const TTL = HOUR_IN_SECONDS;

includes/class-webdecoy-violation-reporter.php

@@ -31,7 +31,7 @@
 class WebDecoy_Violation_Reporter
 {
     /** Ingest batch endpoint. */
-    private const ENDPOINT = 'https://ingest.webdecoy.com/api/v1/sdk/violations/batch';
+    private const ENDPOINT = 'https://in.webdecoy.com/api/v1/sdk/violations/batch';
 
     /** Max events per POST body, matching node's batch size. */
     private const BATCH_SIZE = 100;

includes/class-webdecoy-woocommerce.php

@@ -459,7 +459,7 @@ private function forward_to_webdecoy(string $ip, string $source, int $score, arr
         }
 
         $ingest_url = rtrim($this->options['api_url'] ?? 'https://api.webdecoy.com', '/');
-        $ingest_url = str_replace('api.webdecoy.com', 'ingest.webdecoy.com', $ingest_url);
+        $ingest_url = str_replace('api.webdecoy.com', 'in.webdecoy.com', $ingest_url);
         $ingest_url .= '/api/v1/detect';
 
         $collector = new \WebDecoy\SignalCollector();

readme.txt

@@ -4,7 +4,7 @@ Donate link: https://webdecoy.com
 Tags: bot detection, security, spam protection, woocommerce, ai bots
 Requires at least: 6.1
 Tested up to: 7.0
-Stable tag: 2.7.1
+Stable tag: 2.8.0
 Requires PHP: 7.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -284,6 +284,9 @@ The bundled good-bot list (sdk/src/GoodBotList.php) stores a documentation URL f
 
 == Changelog ==
 
+= 2.8.0 =
+* Changed: the plugin's cloud calls now go to in.webdecoy.com, WebDecoy's DDoS-protected ingest address. Same service, sturdier front door. If your firewall allows outbound requests by hostname, allow in.webdecoy.com. Sites that set a custom API URL are unaffected.
+
 = 2.7.1 =
 * Removed: the canary trip email introduced in 2.7.0. The canary link sits on every public page, so busy sites would receive an email every hour, forever. Detections belong on the Detections page, not in your inbox. Everything else from 2.7.0 stays: the canary URL in settings, the trip-it-yourself prompt, and the Detections page recording every hit.
 

sdk/src/Client.php

@@ -15,7 +15,7 @@
 class Client
 {
     private const DEFAULT_BASE_URL = 'https://api.webdecoy.com';
-    private const DEFAULT_INGEST_URL = 'https://ingest.webdecoy.com';
+    private const DEFAULT_INGEST_URL = 'https://in.webdecoy.com';
     private const DEFAULT_TIMEOUT = 10;
 
     /**
@@ -43,7 +43,7 @@ private static function userAgent(): string
      *   - api_key: (required) Your WebDecoy API key
      *   - organization_id: (optional) Your organization UUID - will be auto-fetched if not provided
      *   - base_url: (optional) API base URL, defaults to https://api.webdecoy.com
-     *   - ingest_url: (optional) Ingest service URL, defaults to https://ingest.webdecoy.com
+     *   - ingest_url: (optional) Ingest service URL, defaults to https://in.webdecoy.com
      *   - timeout: (optional) Request timeout in seconds, defaults to 10
      *   - verify_ssl: (optional) Verify SSL certificates, defaults to true
      * @throws WebDecoyException If required configuration is missing

webdecoy.php

@@ -3,7 +3,7 @@
  * Plugin Name: WebDecoy Bot Detection
  * Plugin URI: https://webdecoy.com/wordpress
  * Description: Protect your WordPress site from bots, spam, and carding attacks with WebDecoy's advanced threat detection.
- * Version: 2.7.1
+ * Version: 2.8.0
  * Requires at least: 6.1
  * Requires PHP: 7.4
  * Author: WebDecoy
@@ -41,7 +41,7 @@ function str_starts_with(string $haystack, string $needle): bool
 }
 
 // Plugin constants
-define('WEBDECOY_VERSION', '2.7.1');
+define('WEBDECOY_VERSION', '2.8.0');
 define('WEBDECOY_PLUGIN_FILE', __FILE__);
 define('WEBDECOY_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WEBDECOY_PLUGIN_URL', plugin_dir_url(__FILE__));
@@ -2662,7 +2662,7 @@ public function inject_js_verification_token(): void
             'user_agent' => $user_agent,
         ];
 
-        wp_remote_post('https://ingest.webdecoy.com/api/v1/page-serve', [
+        wp_remote_post('https://in.webdecoy.com/api/v1/page-serve', [
             'timeout'  => 1,
             'blocking' => false,
             'headers'  => [
@@ -2811,7 +2811,7 @@ private function log_client_detection(array $detection, string $ip): void
      */
     private function forward_to_ingest(array $detection, string $ip): void
     {
-        $ingest_url = 'https://ingest.webdecoy.com/api/v1/detect';
+        $ingest_url = 'https://in.webdecoy.com/api/v1/detect';
 
         // Get API key (decrypt if needed)
         $api_key = $this->options['api_key'];