Book a demo
Book a demo
Login
NewImprovedFixedSecurity

v2.9.3

Know Which Servers Need You, at a Glance

Fleet Monitoring brings every server’s health onto one page, with the servers that need you listed first. This release also adds Plain servers with no web server, a Deployments page for Git sites, team access you can manage from any server or site and one-click LibreChat updates. Backups are more reliable, secrets stay out of task history and many smaller issues are fixed.

🔥 New Features

🆕 Fleet Monitoring

Open Settings → Monitoring to see every server’s health on one page. Servers that are down, at risk, missing data or showing a warning come first, each with the reason in plain words, such as Disk 97% full, and a 24-hour trend. Group your servers by provider, region, web server or tag to see where problems cluster. Learn how to use Fleet Monitoring.

🆕 Plain Servers

Create or connect a Plain server: an Ubuntu server with no web server, PHP or database, for your own apps and tools. It keeps the same security as every xCloud server, including the firewall, Fail2Ban, key-only SSH and automatic security updates. When you want to host sites on it, install Nginx or OpenLiteSpeed from the dashboard, the Public API or MCP. Learn how to create a Plain server.

🆕 Deployments Page for Git Sites

Sites that deploy from Git have a new Deployments page in the site menu. It shows what is live right now, and every deployment’s commit, branch, author and duration. Filter by Failed to find a broken deploy in one click. Learn how to view your deployments.

🆕 Team Access on Every Server and Site

A new Team Access card on the server and site overview shows who on your team can open it. Give or remove a member’s access right there, without opening Team Management. Learn how to manage team access.

🆕 Update LibreChat in One Click

Go to LibreChat → Updates and click Update LibreChat to move to the latest version. Your conversations, users and images are kept. Avatar and chat image uploads work again, and domain changes on LibreChat sites are fixed. You can also run the update through the Public API and MCP. Learn how to update LibreChat.

🆕 More One Click Apps in the Public API and MCP

You can now install phpMyAdmin, n8n, Mautic, Site Pro, Ollama, Open WebUI, Nextcloud, LibreChat, Umami, Supabase and WireGuard through the Public API and MCP. After a WordPress update through the API, you can also read its result, including what was updated and whether a backup ran. See the xCloud API.

✨ Improvements

  • Cron jobs no longer pile up. If a cron job is still running when its next run is due, that run is skipped instead of starting a second copy. The skip is written to the job’s output. This applies to cron jobs you create or save from now on. Cron jobs in xCloud.
  • A private temp folder for each site. Each site user now has its own PHP temp folder, so plugins that cache in /tmp no longer clash between sites on the same server.
  • Clearer reboot and update notices. The Reboot Required notice now separates updates that need a reboot, security updates that install automatically and updates that never install automatically. Package upgrades also wait for a busy package manager instead of rebooting with nothing installed. Automated security updates.
  • Better OpenLiteSpeed PHP settings. Regenerating an OpenLiteSpeed site no longer lowers its PHP worker count, and you can now set a PHP keep-alive timeout.
  • Backup failure digests follow your settings. Slack, Telegram and WhatsApp each follow their own switch for the backup failure digest. Messages now name the failing sites and are translated. Notification settings.
  • Dead chat destinations disconnect. If a Telegram chat blocks the bot or a Slack channel is removed, xCloud disconnects that integration so you can connect it again. Slack integration.
  • Lighter new servers. New servers no longer install the ImageMagick development packages, so you see fewer pending updates that need Ubuntu Pro. What is installed on your server.

🐛 Bug Fixes

Servers and Sites

  • Connecting a server with a public key works again. Connecting your own server with Public Key login no longer fails silently on Create. Connect any provider.
  • Safer domain changes. A domain change now checks every path before it moves anything, and you can’t start a second change while one is running. Change a site’s domain.
  • The env editor keeps your real values. Saving a .env file no longer stores the hidden dots in place of a secret, or Windows line endings, so Git deploys stop overwriting your fixes.
  • Hide My WP preset fixed. The Hide My WP Nginx preset now uses the file name current WP Ghost versions create, so it saves again. Hide My WP on xCloud.
  • The 8G firewall allows MainWP logins. The Nginx 8G firewall no longer blocks MainWP’s Go to WP Admin login. 8G firewall.
  • A hardened wp-config.php stays hardened. Reset Permissions, Site Rescue and domain changes now keep a stricter wp-config.php mode such as 600 or 640. Reset file permissions.
  • No more 502 errors after PHP restarts. Several PHP restarts in a row, common on a new server, no longer leave PHP stopped.
  • PHP versions in use stay installed. You can no longer uninstall the server’s default PHP version or one a site uses, from the dashboard, Public API or MCP.
  • One Click Apps wait until they are healthy. A One Click App template is marked ready only after its health check passes. If it fails, the install shows why. One Click App templates.
  • Docker apps keep their own data. Built-in Docker apps on similar domains can no longer share or remove each other’s containers.
  • WordPress bulk updates no longer fail. Several WordPress updates started at once through the Public API no longer fail with server errors. Updates Manager.
  • The web terminal opens for older sudo users. Opening the web terminal as a sudo user created before March no longer fails with “not found”. Web terminal.
  • Migration DNS check fixed. Verify My DNS on the site migration Domains step no longer shows a false failure. WordPress site migration.
  • Server deletion removes the server at the provider. Deleting a server now removes it at the provider even if you renamed it on Lightsail, or its creation failed partway on Vultr, Linode, AWS or Hetzner, so forgotten servers don’t keep billing you.
  • Site deletion cleans up Cloudflare. Deleting a site now revokes its old Cloudflare origin certificate and removes its Edge Cache and WAF rules from your zone. Edge full page cache.
  • Site Security Pro billing stops on deletion. Deleting a server or site now ends its Site Security Pro bill and records credit for unused time. Deleted server billing.
  • Ignored findings stay quiet. Site Security Pro alert emails no longer mention vulnerabilities you have ignored. Site Security Pro.
  • Clearer errors when creating a server. You see a clear message instead of an error page when xCloud cannot create an invoice for a new server, and one failed Vultr lookup no longer blocks Vultr server creation.

Backups

  • Google Drive backups fixed. Backups no longer fail when Drive has two folders with your site’s name, or when the login expires during a large upload. Google Drive backups.
  • Incremental backups recover. Incremental backups now clear leftovers from an interrupted run instead of failing on every run after it. Incremental backups.
  • No more false backup success. A full backup now fails if its archive could not be written completely, instead of uploading a broken file and showing Completed. Troubleshoot backup failures.
  • Backblaze failures are reported. Failed Backblaze B2 backups now show on the dashboard and send the failure email. Backblaze storage.
  • Backups survive domain changes. Backups taken before a domain change can now be restored and deleted. Site backups.

Email

  • Mail Delivery DKIM updated. Mail Delivery now shows and writes Elastic Email’s new 2048-bit DKIM key, so new domains verify. Mail Delivery.
  • Mail Delivery credits are kept. Deleting an unpaid or failed Mail Delivery purchase no longer takes credits from your active plan.
  • Deleting a mailbox keeps other aliases. Deleting a mailbox removes only the aliases that pointed to it. Email aliases.
  • Enterprise API mailboxes fixed. Buying, deleting and changing the password of a mailbox through the Enterprise API now works like the dashboard.

🏷️ White Label

  • Switching off keeps your content. Turning off your landing page or custom SMTP keeps the saved content for when you turn it back on. Customize your landing page.
  • Product duplicate works. Duplicate opens a short SKU and price form, and the copy keeps its provider, size, site limit and type. Create a product.
  • Price floor on every change. The minimum product price now applies when you edit or duplicate a product too.
  • Links open on your domain. Notification bell links and email links now open on your reseller domain instead of xCloud’s. White label overview.
  • Your brand in security emails. Vulnerability and security update emails to your clients carry your brand, with no xCloud upsell.
  • Cleaner landing page and legal pages. Social links start empty until you add them, the footer shows your copyright name and the default Terms and Privacy pages use your brand name.
  • Accurate client counts. Billing, dashboard client counts and client filters now match your Clients list. White label billing.
  • Safer settings. Logos must be real JPG, PNG or ICO images and link fields accept only web links. Your SMTP password is no longer sent to the browser. Leave it blank to keep it. Custom SMTP.
  • Smaller fixes. The favicon size check, Copy invoice number, card brand logos and the client filter highlight work as expected.

🔏 Security

  • Secrets stay out of task history. Passwords, API keys, environment files and private deploy keys are no longer stored in server task logs, and existing entries are being cleaned up.
  • Notification integrations locked down. Only your team’s notification managers can connect or disconnect Slack, Telegram or WhatsApp. Connection requests are verified and bot tokens stay out of logs. Telegram integration.
  • Storage keys hidden. Backup storage credentials are no longer sent to team members who cannot manage storage providers. Global backup settings.
  • Email settings stay in your team. Email providers and mailboxes can only be deleted or linked within your own team. Mailbox addon.
  • Mailbox passwords are not returned. The Public API and MCP connection settings no longer return the mailbox password.
  • Migration credentials protected. cPanel and full server migration credentials are now encrypted and are no longer sent to your browser. cPanel migration.
  • Snapshots stay in your team. Site snapshots are visible only to their own team, and sites can be built only from ready snapshots. Site snapshots.
  • Support needs your access code. xCloud staff now need your support access code before opening any of your records, not only servers and sites.
  • Safer API input. The Public API now refuses a sudo user name that a site already uses, and server site lists honor their filters. Ollama model names are validated before they run on your server. Sudo users and site users.
  • Mail Delivery payments enforced. Mail Delivery turns on only after payment is settled, and plan changes need payment first.

Please note

  • Cron jobs: overlap protection applies to cron jobs you create or save after this release. Save an existing cron job once to turn it on.
  • 8G firewall and MainWP: on an existing site, turn the 8G firewall off and on again to get the MainWP fix.
  • OpenLiteSpeed: if you edited connection limits by hand, save them again in LSAPI Configurations.
  • Mail Delivery DKIM: if your domain uses manual DNS and DKIM still fails, replace the api._domainkey record with the value now shown on the Mail Delivery page.
  • Public API users: connection settings no longer return the mailbox password. Reset the password if you need a new one.
  • LibreChat: existing sites get the image upload fix the next time you update LibreChat, change its domain or enable Ollama.