v2.9.7.4

Clean up your WordPress database, let Auto Update fix Patchstack findings, and run site commands from the API

You can now clean up and optimize any WordPress site’s database from xCloud, without a plugin. You can take a database backup first, so nothing is lost if you change your mind. Auto Update now fixes Patchstack findings too, premium plugins included, and Supabase stays private by default.

🔥 New Features

🆕 Speed Up Your WordPress Database Without a Plugin

Over time, a WordPress database fills up with old revisions, spam and leftover data that slow it down. Until now, you needed a plugin to clear it. Now every WordPress site has a new Optimization page in its menu, right after Caching.

Who it’s for: WordPress site owners and agencies.

• What it removes. Post revisions, auto-drafts, trashed posts, spam, pending and trashed comments, empty tags and categories, transients, orphaned post and comment meta, and the oEmbed cache.
• Optimize your tables. Tick Optimize Database Tables to tidy the tables themselves after the cleanup.
• Preview first. Preview shows how many items each action will delete before anything is removed.
• Choose what stays. Keep Last N Revisions keeps your newest revisions. Transient Cleanup Mode lets you pick Expired Only or All Transients.
• Back up database first. Tick it, and xCloud takes a database backup and waits for it to finish before deleting anything. If the backup fails or times out, nothing is deleted. The backup is a normal restore point on the site’s Backups page.
• Automatic cleanup. Run the actions you chose on a Daily, Weekly or Monthly schedule.
• Cleanup History. See every run with its counts, the space freed, what started it (manual, scheduled or API) and its status.
• Your data stays yours. Our support staff cannot run a cleanup on your site.

Clean up and optimize your WordPress database in xCloud

🧑‍💻 For Developers: Public API and MCP

• Database Cleanup. Preview a cleanup with POST /api/v1/sites/{uuid}/database/cleanup/preview, run it with POST /api/v1/sites/{uuid}/database/cleanup, and read its history with GET /api/v1/sites/{uuid}/database/cleanup/history. All three are also MCP tools.
• Run a tracked command on a site. POST /api/v1/sites/{uuid}/commands runs one command as the site’s user and returns a task. Poll GET /api/v1/sites/{uuid}/commands/{task} for its status, exit code and up to 60,000 bytes of output. You no longer need temporary cron jobs to run a one-off command from a script.
  • Opt in per token. The call needs a token with the commands:run ability (a wildcard token is not enough), two-factor authentication on your account, and Command Runner permission on the site.
  • Safe to retry. A repeated request never runs the command twice.
  • Site user only. Commands never run as root. The command text and output are not stored in the audit log.
• Purge the page cache on many sites at once. POST /api/v1/sites/bulk/cache-purge purges the page cache on 1 to 100 WordPress sites in one call, with an optional dry run. Poll GET /api/v1/sites/bulk-operations/{uuid} for each site’s result. It is also an MCP tool that asks for your confirmation before it runs. It purges the page cache only. Cloudflare and object cache are not touched.
• Server vulnerability settings. Read and change a server’s Vulnerability Settings (scan, Enable Auto Update, auto backup and the sites they cover) with GET and PUT /api/v1/servers/{uuid}/vulnerability-settings, or from an AI agent through MCP. You can find every server with Auto Update off, or switch it on across all your servers, without opening each one. Vulnerability checker in xCloud

🔒 Security

• Supabase is private by default. Supabase Studio, Logflare and Kong can now only be reached from the server itself. New installs keep the database and connection pooler there too, so you connect over an SSH tunnel. Before, they were open on the server’s public IP, past the firewall.
  • A domain change also makes an existing install’s Studio, Logflare and Kong private. Its database stays where it is.
  • Each Supabase site now gets its own pooler port, so a second Supabase on one server starts properly.
  • An install only reports success when every service is running.
• Server scripts are stored more safely. The monitoring and backup scripts that run as admin now live in a folder only the admin account owns, not in the xcloud user’s home folder.
• Server task logs keep their content. When a log has a very long value that looks like a password or key, xCloud now hides that value instead of erasing the log.

⚡ Improvements

• Auto Update now fixes Patchstack findings. With Enable Auto Update on under Server → Security → Vulnerability Settings, known vulnerabilities found by Patchstack are now fixed automatically, not only Wordfence findings. If a finding could not be fixed, xCloud tries again the next day.
• Premium plugins get fixed too. The vulnerability fix now updates plugins that update from inside the plugin, such as Rank Math Pro. Before, they were silently skipped.
• You can see when findings are out of date. If the latest Patchstack refresh fails, Site Security Pro says so under Last Scanned and shows the last known findings. The daily refresh now also updates the Last Scanned time.
• Broken-link alerts are back, with a switch. Broken-link alerts reach Slack, Telegram, WhatsApp, Discord and webhooks again. A new Broken Link Notifications switch under Profile → Notifications turns them on or off. New accounts start with it on. If you stopped getting these alerts, turn it on. Monitor and fix broken links
• Docker Compose ports from your .env file. When you deploy a Docker Compose app from Git and finish editing your .env file, xCloud checks the ports again. A port set in your .env file now shows up in Primary port, for example ${HOST_PORT}:8080. xCloud now understands every variable form Compose supports (${PORT-8080}, ${PORT:?}, ${FLAG:+7070}, bare $PORT). It also adds a .env line for any required variable that is missing. Deploy a custom Docker application from Git
• PHP changes no longer cut visitors off. Syncing clone and staging settings, and editing a site’s PHP settings, now reload PHP gently instead of restarting it. Requests already in progress finish normally.

🐞 Bug Fixes

• Backups
  • A failed restore no longer shows up as a failed backup, marks the backup destination as failed, or emails you that a backup failed.
  • Expired S3 and SFTP backups with no saved location are now removed by your retention settings again.
• Cloudflare
  • Turning on Cloudflare SSL no longer renames www and alias DNS records to the primary domain, and the proxy status is now applied.
  • Turning off Under Attack Mode now restores your earlier Security Level instead of setting it to Medium.
  • Verify no longer turns on a disabled Cloudflare Enterprise domain.
• Mailbox
  • The migration summary now shows forwards that the new mail provider refused as failed.
  • Cancelling a migration now reports errors when a new mailbox could not be removed, instead of reporting success.
  • A mailbox payment no longer reports success for a mailbox it skipped.
• Databases
  • Changing a database user’s password now also updates a Node.js site’s .env file.
  • A migration with a database user and an empty password now gets a generated password instead of failing.
  • Choosing MySQL for a new WordPress site no longer fails.
• Page cache
  • OpenLiteSpeed and LiteSpeed cache purges now reach the server itself, and show as failed if they do not arrive. Before, they reported success while pages stayed out of date.
• One-click apps
  • Umami, Nextcloud and Open WebUI now keep working after a backup restore or restart that follows a domain change.
• Docker from Git
  • A verified SSH deploy key now passes the repository access check.
• Billing
  • Creating an xCloud Managed or xCloud Provider server with backups no longer fails when xCloud cannot get the backup price from Vultr.
  • An invoice number that does not exist now returns “not found” (404) instead of a server error.
• Site overview
  • The PageSpeed gauge now keeps each device’s latest score after a scan that partly failed.
• Support tickets
  • A ticket for another team you belong to now lists that team’s servers and sites, and opens after you create it.
• Object Cache Pro
  • The integration search now filters by what you type.
• Modals
  • Footer buttons in the firewall and Nginx customization windows no longer sit on the bottom edge.

Also live since v2.9.7.3

• Staging and demo sites can now be deleted without giving a reason. “It was temporary” is also a new delete reason.
• MariaDB security patch (AL-2026-144) now works on servers with a non-English system language. If the version check stops, you now see Retry update. The notice also makes clear that its update times are the earliest possible.