Book a demo
Book a demo
Login
NewImprovedFixedSecurity

v2.9.6

Login Protection You Can Trust, Token-Only Cloudflare, and More for the API

This release replaces WP Fail2Ban with BetterShield login protection, lets you connect Cloudflare with just an API token, and brings server PHP extensions, php.ini settings, server and site metadata and WordPress deactivation to the Public API and MCP. A weekly email now tells you which servers run without backup protection. It also carries a large round of security hardening across backups, Cloudflare, mailboxes and webhooks, and many fixes. The v2.9.5.1 update from 25 October is included too.

🔥 New Features

🆕 BetterShield Login Protection Replaces WP Fail2Ban

Login Protection on a WordPress site’s Security page now installs BetterShield instead of WP Fail2Ban. BetterShield blocks repeated failed logins in WordPress and, through xCloud, also bans the visitor’s network at the server firewall for 15 minutes, so an attacker cannot keep trying from the same block. It trusts Cloudflare’s visitor IP only when the request really comes from Cloudflare, so Cloudflare edges are never banned.

  • Opt-in per site. Nothing is installed until you turn it on. Sites that already use WP Fail2Ban keep working and show a Switch to BetterShield notice. Turn on the switch on the WP Fail2Ban & Login Protection card, and xCloud removes WP Fail2Ban, then installs BetterShield, free.
  • Strict by default. BetterShield starts with every protection on. Turn each one on or off from the site’s Security page: the failed sign-in limit, the bot and proof-of-work checks, comment, password reset and registration protection, common usernames, public user listing and pingbacks.
  • Hardening at install. Turning BetterShield on also turns off the dashboard file editor, adds security headers, hides the WordPress version, stops uploads folders listing their files, tightens wp-config.php permissions where needed and moves an http:// site address to https:// when the site has a working certificate. BetterShield needs WordPress 6.7 and PHP 8.0 or newer.
  • Public API and MCP. New /api/v1/sites/{uuid}/bettershield endpoints turn BetterShield on or off, switch a site from WP Fail2Ban, and read or change its settings.
  • Redesigned Security page. Every security setting on a site now lives under one Security menu, with on/off switches in each card header and a cleaner layout.

Set up BetterShield login protection

🆕 Connect Cloudflare With an API Token Only

Cloudflare retired Origin CA keys on 30 September 2026, and xCloud no longer needs a Global API Key either. A new Cloudflare integration takes a scoped API token and nothing else; every call to Cloudflare uses that token. Existing integrations keep working: if your token lacks a permission, xCloud falls back to your saved Global API Key, records which permission was missing, and shows it on the integration with an Update Token button. Error messages now name the exact permission to add, such as Zone › SSL and Certificates › Edit.

🆕 PHP Extensions and php.ini Through the Public API and MCP

Server PHP extensions and server-wide php.ini settings can now be managed outside the dashboard. The Public API lists installed and available extensions per PHP version, installs or removes an extension as a tracked task, and reads or updates php.ini settings. The same operations are available as MCP tools. The xCloud AI Assistant can list and install extensions and change php.ini settings; removing an extension stays with you.

🆕 Server and Site Metadata, Tag Filters and WordPress Deactivate in the API

  • Rename a server or site, set tags and notes with PATCH /api/v1/servers/{uuid} and PATCH /api/v1/sites/{uuid}, and filter server and site lists by tag.
  • Deactivate WordPress plugins or themes with POST /api/v1/sites/{uuid}/wordpress/deactivate, tracked the same way as activation.
  • Reinstall a server’s monitoring agent from the Monitoring page, the Public API or MCP without losing monitoring history.

🆕 Weekly Backup Reminder

A weekly check emails your team, at most once every 30 days, a list of servers whose production sites have neither an active remote backup nor provider backup, so a missing backup never stays unnoticed until a restore is needed. Servers younger than 7 days are skipped. The email is on for everyone; turn it off under Settings → Notifications → Backup Reminders.

🆕 Redeem Add-ons You Already Bought

An add-on bought in the cart but not set up yet, such as a Mailbox or Site Security Pro credit, now appears on its own page with a Continue Setup option that uses the credit instead of charging again.

🔒 Security Improvements

  • Backups. Backup callbacks accept only plain file names and folders, restore refuses records that do not look like a real backup, and every stored name is safely quoted in the restore and delete scripts.
  • Scripts that run as root on your server, for logs, SSH keys and the OpenLiteSpeed firewall, now refuse symbolic links and write site files as the site user.
  • Webhooks. Stripe events are applied only when they come from the account that bills your team, and the split-payment webhook checks its secret before doing anything.
  • Secrets off the page. TLS private keys, Stripe tokens, Elastic Email keys, Slack and Telegram secrets, DigitalOcean and GCP credentials, and the support access code no longer appear in page data, logs or task scripts. Support tickets show only the sites and servers you may open.
  • Addresses checked. Storage provider endpoints, cPanel hosts, migration sources and enterprise server addresses must be public addresses.
  • Permissions. Vulnerability scans in the API need the site:vulnerability-scan permission; a mailbox alias can only be created on a domain your team owns; an invitation can only be accepted by a verified email address; white-label wholesale and product deletion are authorized.

✨ Improvements

  • Faster Cloudflare checks. xCloud looks a zone up by name instead of listing every zone of every connected account, so teams with large Cloudflare accounts no longer hit timeouts or rate limits.
  • PageSpeed scan limits. One scan per site every 10 minutes and 30 per team per hour keep the shared Google quota available for everyone. The message tells you how long to wait.
  • Faster site lists. The All Sites list and the command palette load less data.
  • Hetzner sizes per location. The server create page shows which Hetzner sizes are available in the chosen location and greys out the rest.
  • Reseller panel. The Last 1 Year invoice filter works, page links keep your filter, search and sort, settings links follow permissions, the onboarding product modal lists your providers, each reseller’s custom SMTP is used for its own emails, and a client’s team email follows the client email.
  • PHP 7.4 minimum for fresh WordPress installs and PHP switches.
  • Server Settings page. A new server page groups the services you can install.

🐛 Bug Fixes

  • Backups. Scheduled backups no longer overlap or hang a server; a failed SFTP backup is recorded as failed; a Docker restore uses the exact image its backup recorded; two sites with the same domain keep separate remote folders; remote backups are only forgotten after the provider confirms deletion.
  • Cloudflare. The script-tag WAF rule no longer blocks logged-in admin-ajax.php saves; deleting a site or server keeps a DNS record that now points at another server; WAF and edge cache rules follow a domain change; a new Origin CA certificate is installed before the old one is revoked; Cloudflare Enterprise domains are cancelled on every permanent server delete.
  • PHP. A PHP install or site PHP switch no longer stays stuck on “installing” when another install holds the package lock; PHP 8.3 can be uninstalled on Nginx servers; on OpenLiteSpeed, xCloud refuses to remove the PHP version OpenLiteSpeed depends on instead of removing OpenLiteSpeed with it.
  • Firewalls. The OpenLiteSpeed 8G firewall is updated to v1.5, which stops blocking WP Export, /login/ pages and SAML SSO; 7G no longer blocks the xSpeed Database panel or OAuth logins; the firewall log holds real blocks only and shows the blocking rule; AI Bot Blocker no longer blocks AI assistants acting for a user, such as Claude-User and ChatGPT-User.
  • Mail. A mailbox that failed to delete is no longer reported as deleted; renaming an alias moves it at the provider; adding Mail Delivery or Mailbox records keeps your existing SPF; a declined Mailbox purchase cannot be activated by reopening the payment page; custom SMTP providers are no longer billed; add-on bills are back on the monthly invoice.
  • Apps. Supabase keeps accepting connections after a permission reset; a WireGuard site keeps its version on domain change; two one-click installs at once no longer deadlock; Open WebUI sign-ups no longer become admins and LibreChat registration is closed on new installs.
  • Notifications. Telegram alerts arrive when a server, site or plugin name contains < or &.
  • Other. A disabled site on OpenLiteSpeed shows its saved disabled-site page; the SSH Key page loads for very large teams; a password-mode migration can switch to a public key; the Plain stack shows its own icon; an unverified invitee is sent to verify their email instead of an error.

Please note