v2.9.10

See Which Site Is Slowing Your Database, and To-Do Items That Close When You Fix Them

MySQL in Site Insights now shows your own site’s queries and names the site behind each one. To-Do cards show a running fix as progress, and many items now close the moment you fix the cause. AI agents connected to xCloud must now confirm before they read app passwords.

🧑‍💻 For Developers: Public API and MCP

• App passwords over MCP: oneclickApps.credentials now needs confirm: true on every MCP endpoint (/mcp, /mcp/v2 and execute). Without it you get a preview or a refusal, and no password. The REST Public API is unchanged.
• Outside text in results: MCP reads that can contain text from outside your team, such as logs, alerts and To-Do results, return untrusted_content: true. Values that look like passwords or keys are hidden in them.
• Banned IPs: when SSH cannot reach the server, GET /servers/{uuid}/fail2ban/banned-ips now answers 502 with errors.code server_unreachable and next_actions reconnect_server and retry_later. Other failures return a plain message without server details.
• To-Do actions: POST /todos/{key}/actions/fix, skip and restore_target without a target now return 422 on target, instead of a 404 that looked like a permission problem. Use fix_all to act on every target.

🔒 Security

• AI agents and your passwords: an AI agent connected to xCloud must ask you to confirm before it reads One Click app passwords.
• AI agents and logs: An AI agent connected to xCloud now treats text in your logs as information only, so a log line can’t trick it into doing something. Passwords and keys no longer appear in the logs it reads.

⚡ Improvements

See Which Site Is Behind Each MySQL Query

Before, MySQL in Site Insights showed queries from every site on the server as if they were your site’s own. You could spend hours tuning the wrong site. Now each query names its site, and whole-server numbers are marked as such.

Who it’s for: WordPress site owners and agencies with several sites on one server.

• Open your site, then Site Insights → MySQL. By default it shows only this site’s queries, connections and slow log entries.
• Switch to Every site on this server to see every site’s queries, each with its site and database.
• The Summary tab carries a Whole server tag, and a Database time by site table shows each site’s share.
• A team member with access to one site only sees that site’s queries, never another site’s.
• The AI assistant names the site of each query too. It names a plugin only when the query uses a table that belongs to that plugin.

How to Monitor Website Performance with Site Insights on xCloud

To-Do Cards Show a Running Fix as Progress

Before, a To-Do card kept saying Needs attention while its fix was already running. Now it shows what is happening.

Who it’s for: Everyone who uses the To-Do Center.

• While a fix runs, the card shows In progress and a heading such as “Fixing 2 sites”, with a line on what the fix changes.
• The steps show as they happen: Fix started (or Waiting to start), Checking result and Fixed, verified.
• Snooze, Ignore, Mark done and Ask AI why (or Fix with AI) are hidden while the fix runs.
• When the fix closes the item, the card says Moved to Done. When it does not finish, it says Didn’t finish, gives the cause and offers Retry or Retry all.

🐞 Bug Fixes

• Domains
  • Domains with accented or non-Latin letters, such as café.example.com, now work for new sites, domain changes, going live and clones. Before, the form said “The domain name is not a valid domain.”
  • Such domains now match their Cloudflare zone, so DNS records are set up for them.
• To-Do
  • Backups are failing now closes once a Backup Now to the same destination succeeds, or when you turn the schedule off.
  • SSL failed no longer stays open on Cloudflare multi-domain sites whose current certificate works.
  • Low disk space and High CPU no longer stay open on old monitoring data after you fixed the cause.
  • Suspended server and site cards now close as soon as the suspension is lifted.
  • Messages for items you cannot skip or fix no longer suggest snooze or the AI assistant when those are not available.
  • Add the deploy key now closes as soon as Verify connection succeeds.
  • A PHP security patch is needed now closes once every PHP version with a fixed release is patched.
  • When a fix cannot turn a disabled site back on, the dashboard no longer shows the site as enabled.
  • If a full disk breaks the Cloudflare Enterprise cache-purge plugin, reinstalling it no longer says Fixed before it is done, and your current plugin stays in place.
• AI Assistant
  • The link icon that opens each item in an AI assistant result list shows again, and its screen reader labels are in your language.
• Google Cloud
  • Every server size in the size list now shows its own name.