Book a demo
Book a demo
Login
NewImprovedFixedSecurity

v2.9.7.2

toSend for Mail Delivery, Tighter Support Access, and Fixes Across Backups and Billing

This follow-up to v2.9.7 adds toSend as a Mail Delivery provider, with a real FluentSMTP test and status check on every WordPress site. Support staff now need your SSH consent before they can open site credentials or the database auto-login. The rest is fixes you asked for: remote backup restores, weekly Vultr backups, cancelled payments, renewal dates, Cloudflare Enterprise domains, database passwords, Mail Delivery From names, mailboxes, OpenLiteSpeed PHP and BetterShield on staging.

🔥 New Features

🆕 toSend as a Mail Delivery Provider

toSend joins the providers you can connect under Mail Delivery. Choose toSend, paste your sending key and xCloud fills in the SMTP host, port, encryption and username for you. An admin key is refused with a clear message, so the wrong key never ends up on a site.

  • Send Test Email. On a WordPress site’s Mail Delivery page, the test now goes through FluentSMTP itself, from the From address you saved, and shows the provider’s real answer instead of a generic success.
  • Check FluentSMTP. One click shows each FluentSMTP connection’s state, how many emails were sent or failed, and the plugin version, so you can see whether a site is actually sending.
  • Older FluentSMTP versions that cannot run these checks are updated when you save the provider.

Configure toSend for site emails

🔒 Security Improvements

  • Your SSH consent covers credentials and database auto-login. Support staff can only open a site’s Credentials page, the secrets on the site’s other pages, and the phpMyAdmin and Adminer auto-login after you have given SSH consent, the same rule that already protects the web terminal and env files.
  • Migration source URL guard. The addresses the guard approved are pinned, so a migration fetch cannot be redirected to a different host after validation.
  • Google Drive and pCloud. Connecting a storage account only completes for the user who started it.

✨ Improvements

  • Cloudflare Enterprise origin certificates. When a per-server origin certificate cannot be issued, the failure is recorded and shown on the domain row, you are alerted once, and xCloud waits 60 minutes before trying again. Support can retry it for you.
  • Vulnerability scans. The WordPress plugin and theme inventory the scan reads now refreshes daily instead of weekly, and a daily guard makes sure no open finding goes unreported.
  • Vulnerability alerts in Slack. Patchstack vulnerability alerts reach your Slack channel when Vulnerability Notifications is on.
  • Clearer database errors. When adding a database or database user fails, the page shows the server’s own error instead of a generic message.

🐛 Bug Fixes

  • Backups. Remote S3 backups restore from the per-site folder they were uploaded to. Weekly Vultr server backups run on the day you picked. Cloning a site copies only the backup destinations you ticked.
  • Billing. Cancelling a pending payment no longer removes a paid, running server. A server restored on the 28th to 31st keeps this month’s renewal date. A tag whose slug already exists no longer hangs the request or strands billed servers.
  • Cloudflare Enterprise. A domain you disabled stays disabled after another purchase on the site or its renewal.
  • Databases. MySQL Configuration shows exact sizes, so saving the page no longer changes the buffer pool. Changing a database user’s password also updates the Laravel .env. A failed PHP settings read no longer wipes your stored settings or blocks saving.
  • Mail Delivery and mailboxes. Rotating the Mail Delivery API key keeps each site’s own From Name. A mailbox activated by support now survives its renewal.
  • OpenLiteSpeed. The server-level lsphp handler stays on the server’s default PHP.
  • WordPress. BetterShield settings survive a staging push and pull. Removing WP Fail2Ban no longer breaks wp-config.php.
  • Migration. A Full Server Migration fetch no longer hangs when a site has additional domains.

Also live since v2.9.7.1 (28 October)

  • MariaDB security patch (AL-2026-144) applied to existing MariaDB servers in a staged rollout.
  • Site SSH password is withheld from support staff until you give SSH consent.
  • Server resize reports success only after the provider has confirmed the plan change.
  • Site PHP settings save for that site only, instead of rewriting every PHP-FPM pool on the server.
  • Coupon renewals charge what you actually paid and show that amount as Cost Next Month.
  • White-label mail delivery accepts non-standard SMTP ports (SES, SMTP2GO) again.
  • 3DS payments settle correctly.
  • Migration restart is refused while a migration is already running or finished.
  • nginx.org upgrades no longer stop on an unrelated broken APT source.