Book a demo
Book a demo
Login
NewImprovedFixedSecurity

v2.9.2

Run Your AI Agents on Your Own Infrastructure

Hermes and OpenClaw can now run on a supported connected cloud account or your own VPS. This release also simplifies WordPress setup, adds device-specific Cloudflare Enterprise caching, lets you download server logs, restores database management in the Public API and MCP, and groups scheduled backup failures into a single digest instead of one email each.

🔥 New Features

🆕 Hermes and OpenClaw on Your Own Servers

Run either AI agent on a supported connected cloud account or your own VPS, instead of only on a server xCloud provisions for you. Each agent needs a dedicated server with at least 4 GB of RAM.

🆕 Device-Specific Cloudflare Enterprise Caching

Cache separate page versions for mobile, tablet and desktop visitors, so each device gets a page built for it. Enable this optional setting per domain alongside edge page caching. It is off by default.

🆕 Download Server Logs

Export supported server logs from the dashboard, the Public API or MCP when you need to troubleshoot. xCloud emails you a link to a compressed file of up to 10 MB, and the link is valid for 24 hours.

🆕 Database Management Through the Public API and MCP

Create, find, update and delete MySQL and MariaDB databases and users, manage access, and rotate passwords with nine restored operations. Safeguards prevent you from deleting a database that a live local site is using.

✨ Improvements

  • A clearer WordPress setup experience. A refreshed app catalog and WordPress setup step make configuration easier, with clearer field errors, backup choices and domain handling. The additional-domain suggestion no longer repeats the primary domain.
  • Less backup email noise. Scheduled backup failures are grouped into a digest for each eligible recipient, covering only the sites that person can access. The default collection window is two hours. Failures of a manual backup still notify you immediately.
  • More responsive migration setup. Server migration connection checks now run in the background, with progress feedback while SSH access is verified.
  • Easier troubleshooting. Related errors are grouped more consistently, and request IDs help trace an operation across requests, jobs and server callbacks.
  • Support diagnostics by support code. Support can diagnose a server, including one with no sites, using consent-scoped access and a valid support code. Your team’s opt-out is still respected, and existing trusted-agent access is unchanged.

🐛 Bug Fixes

  • Monthly billing retries. If invoice generation or the payment-job handoff fails, it can resume without the month being wrongly treated as completed.
  • Safer manual database migrations. Imports stop on a missing or invalid database dump or an import error, and identify the correct WordPress table prefix.
  • Accurate migration status. A finished, failed or cancelled migration no longer returns to an active state because of a late update, and status views report the latest attempt.
  • Google Cloud account isolation. Saving a Google Cloud project no longer overwrites another team’s connection that uses the same project ID.
  • More reliable cross-server transfers. SSH keepalives reduce idle disconnects during long clone, migration and snapshot transfers.
  • Docker backups in the team overview. Supported Docker app sites now appear in the backup overview tabs, filters and statistics.
  • Stable Docker Compose projects. Deployments and environment edits keep each site’s Compose project identity, which prevents unintended extra stacks and project conflicts.
  • Cloudflare Enterprise origin SSL checks. Origin SSL settings now rely on a recorded certificate installation, which helps prevent handshake failures caused by hostname-only assumptions.
  • File access after a domain change. The site user’s files shortcut is repaired before the WordPress URL replacement, so SSH and SFTP navigation keeps working even if the replacement fails.
  • Correct ID and UUID matching. Account and server lookups no longer confuse a UUID that begins with digits with a numeric ID.
  • Safer deletion retries. Retrying an older failed site deletion keeps the database and site user when the original deletion choices were not recorded.
  • OpenLiteSpeed settings stay saved. LSAPI overrides set to zero are preserved when you save or copy security settings.
  • Safer backup-tool upgrades. Eligible legacy duplicity upgrades now use an isolated environment, without removing unrelated server packages or changing system Python libraries.
  • Deleting renamed Compose sites. A renamed Custom Docker Compose site can be deleted correctly, and a domain change keeps the site user’s ownership of its environment file.
  • Cloudflare Enterprise subdomain certificates. New subdomain setups include certificate-validation records, so SSL can be ready before live traffic moves to the edge.
  • Safer Redis Object Cache activation. Redis is installed first when it is missing, and a failed activation no longer leaves a broken cache connection or a switch that looks enabled.
  • Better OpenLiteSpeed connection limits. Default PHP connection limits now account for the OpenLiteSpeed worker count, which reduces connection oversubscription.
  • Cloudflare Enterprise protection syncing. Shared firewall and rate-limit rules handle larger domain lists, and WordPress exception rules update correctly when they are already in position.
  • Cloudflare Enterprise DNS status. A valid root-domain A record no longer stays on “Checking…” because unrelated DNS record types are absent.
  • Cleaner All Sites actions. One-click app actions no longer overlap the Essentials column and stay available for stopped apps.
  • Accurate resource reporting. Disk usage counts the root filesystem once instead of duplicating mounted storage, and site memory attribution is corrected.
  • Broken-link scans on OpenLiteSpeed. Scans choose a PHP runtime that has the required extensions and show a specific error when none is available. Repair tooling also fixes affected PHP command-line links.
  • Controlled SSL provider changes. Switching away from Cloudflare Enterprise SSL now asks for confirmation and temporarily disables the affected Enterprise domains before the new provider is applied. Your subscription is kept.
  • Correct Google Cloud plan lookup. Server sizing uses the Google Cloud connection you selected, not the first one saved for the team.
  • Safer pCloud restores. A restore stops when a requested backup identifier or a required database file is missing, and a failed restore shows a clearer status.

🔏 Security

  • Safer backups, staging and blueprints. Backup operations enforce site ownership, staging table names are validated and quoted, and blueprint inputs and private-team access get stronger checks.
  • Consistent restore and snapshot permissions. Restore and snapshot installation check permissions on both the source resource and the destination, including snapshot creation through the Public API and MCP.
  • Protected process-management access. Support access-code checks are restored on the server’s Supervisor process edit page.
  • Protected WordPress bulk-update results. Bulk-operation callbacks use expiring links and signed results. Operations already running during the deployment keep working.
  • Safer Stripe connections. Linking a white-label Stripe account validates the session it came from and rejects expired or reused authorization attempts.
  • Correct white-label domain routing. Custom domains no longer collide with reseller subdomains, and reserved platform addresses cannot be claimed as custom domains.
  • Stronger WordPress Redis separation. Eligible WordPress sites use dedicated Redis databases on Redis 7 and later once the configuration rolls out. Redis 6 gets only partial protection, and this change does not give non-WordPress apps equivalent isolation.

Please note

  • Hermes and OpenClaw on your own servers need a dedicated server with at least 4 GB of RAM.
  • Device-specific Cloudflare Enterprise caching is optional and off by default. Turn it on per domain.
  • The OpenLiteSpeed connection-limit change applies to an existing configuration the next time its settings are saved or regenerated.
  • The Redis separation change applies once the configuration has rolled out to a server. Redis 6 gets only partial protection.