Book a demo
Book a demo
Login
NewImprovedFixedSecurity

v2.9.1

Back Up Every Site to Two Storage Providers

A site can now send its backups to two storage providers at once, each on its own schedule with its own retention, so one provider outage or one deleted bucket no longer means losing your off-server copy. This release also shows you why CPU or RAM is high in Live Monitoring, makes firewall IP blocks take effect as expected, and fixes several issues with PHP, SSL and WordPress updates.

🔥 New Features

🆕 Multiple Backup Destinations per Site

Until now a site could back up to one storage provider plus the server itself. Now each site can use up to two remote storage providers as well as the local destination, and every destination runs independently:

  • Its own schedule and retention. For example, daily backups to Backblaze B2 kept for 30 days, and weekly backups to Cloudflare R2 kept for 90 days.
  • Retention presets. Choose 3 days, 1 week, 2 weeks, 30 days, 2 months, 3 months, 6 months or 1 year, or enter a custom number of days.
  • The newest backup is always kept. Retention never deletes the latest backup of a destination, so if backups stop running, your last good one survives.
  • Per-destination history. Previous Backups shows each destination separately, and Backup Now runs for the destination you select.
  • Safe removal. Removing a destination either keeps its stored backups (they come back if you add the same provider again) or deletes them, your choice. If the provider can’t confirm the delete, the destination is kept and nothing is lost silently.
  • Team defaults. Team-wide backup settings can hold two remote destinations too. New sites receive every team default, and bulk apply updates one destination without touching a site’s other providers.
  • Docker sites included. Docker apps can replicate to two remote destinations, and their backups can now run every 12 hours.

Two destinations can’t share one bucket, because each would delete the other’s backups. Existing backup settings keep working, with nothing to change.

Learn more: Site backups in xCloud, Global backup settings and Docker app backups.

🆕 See Why CPU or RAM Is High

When live CPU or RAM usage crosses the alert threshold, the server header in Live Monitoring now shows which processes are using it, in plain language, instead of only a red bar. You no longer need to SSH in to find the cause.

Learn more: Live server monitoring.

✨ Improvements

  • New commercial plugin versions show up in update checks. Refreshing updates, including a bulk refresh across sites, now lists new releases of commercial plugins, and plugin versions shown after a bulk update stay correct.
  • Clearer staging DNS errors. When a staging or demo site’s DNS record can’t be created, for example because the Cloudflare zone is missing, you now get a clear error instead of a staging site that silently has no DNS.

🐛 Bug Fixes

  • 502 after a PHP update or SSL renewal. The task could report success while the site returned 502 because its PHP-FPM pool was missing. The pool is now always in place before Nginx uses it.
  • HTTPS kept when an SSL provider switch fails. Switching a site to Cloudflare SSL no longer breaks HTTPS if the new certificate can’t be issued; the working certificate stays.
  • Security overview counts every vulnerability. The total now includes every finding, not just the number of affected plugins and themes, so it matches the tables below it.
  • WordPress core updates install the latest release. “Update WordPress Core” now installs the release available when the update runs, and the Updates page shows the installed version right away.
  • Rotated admin passwords in Docker apps. An admin password changed in a Docker app’s environment file now also updates the site’s credentials in Access Data.
  • PHP 8.5 memory limits. A higher memory limit set in the dashboard now really applies on PHP 8.5, instead of PHP staying capped at 512M.
  • Wordfence vulnerability matching. Advisories for one vendor’s plugin no longer attach to another vendor’s plugin with a similar name, and Ignore/Unignore is saved reliably.

🔏 Security

  • Firewall IP blocks now really block. A server firewall rule for an IP address or range now takes effect ahead of broader allow rules, a guard stops a block from locking xCloud out of your server, and OpenLiteSpeed site IP blacklists are applied correctly.
  • No more self-signed certificate on unknown hosts. Nginx now rejects HTTPS requests for hostnames it doesn’t serve instead of answering with a self-signed certificate, which PCI scans such as Qualys flagged. Existing servers pick this up the next time one of their sites’ Nginx configuration is regenerated.

Please note

  • The local backup on the server is separate and doesn’t count toward the two remote destinations.
  • If you remove a backup destination and choose to delete its stored backups, those files are deleted from your storage provider permanently.