Book a demo
Book a demo
Login
NewImprovedFixedSecurity

v2.9.7

PostgreSQL on Your Servers, Alerts in Discord, and Bulk PHP for the API

This release brings managed PostgreSQL to xCloud: one shared install per server, pgAdmin to manage it, and a MySQL-or-PostgreSQL choice when you create a Git-based site. Alerts can now go to Discord or to any HTTPS endpoint you run, signed so you can trust them. The Public API and MCP gain bulk PHP switching, redirect management, vulnerability scan settings and the list of WordPress versions you can install. It also hardens database management, Cloudflare’s sensitive-file rule and Telegram linking, and fixes a long list of backup, delete, Mail Delivery and billing issues.

🔥 New Features

🆕 Managed PostgreSQL and pgAdmin

A server can now run one managed PostgreSQL service that every PostgreSQL site on it shares. Choose it when you create a server, or install it later from Server Management → Install a Service on an existing Nginx server. The card shows queued, installing, ready and failed states and lets you retry a failed install.

  • pgAdmin, managed for you. Enable pgAdmin next to the PostgreSQL card, open it over HTTPS with its own web credentials, and manage databases and roles there. Disabling pgAdmin keeps your data: databases created in pgAdmin move to the owner role instead of being deleted.
  • PostgreSQL sites. Native Git sites (Node.js, PHP and Laravel) can pick MySQL or PostgreSQL at creation, in the dashboard and in the white-label site form. A database and role are created for the site and written to its environment. Deleting the site keeps its database and role and tells you so.
  • Requirements. Managed PostgreSQL needs an Nginx server with Docker Engine 28 or newer. PostgreSQL sites do not support cloning, migration, staging or snapshots yet, and PostgreSQL databases are not part of site backups yet; export them from pgAdmin before you rely on a backup.

🆕 Discord and Signed Webhook Notifications

Two new notification integrations join Slack, Telegram and WhatsApp under Settings → Integrations → Notification.

  • Discord. Paste a Discord channel webhook URL and alerts arrive in that channel with a bold title and an Open link to the server or site.
  • Webhook. Enter any HTTPS endpoint you run. xCloud posts each alert as JSON and signs it with HMAC-SHA256. The signing secret is shown once, and the guide shows how to verify it in PHP and Node.js.
  • Your choice of alerts. Discord and Webhook have their own switches for server, site and other notifications under Settings → Notifications, separate from Telegram.
  • Send test notification on each integration delivers a test alert right away and shows the result.
  • Safe by default. HTTPS only, private and internal addresses are refused when you add the integration and again before every delivery, and redirects are not followed. A deleted Discord webhook removes itself, and the URLs and secret are stored encrypted.

Send xCloud notifications to Discord or a webhook

🆕 Bulk PHP Switching and Redirects in the Public API and MCP

  • Switch PHP for up to 100 sites in one call. Preview the change, then run it; xCloud sequences the switches per server and reports each site’s result as a task you can poll. An AI agent can now do “PHP 8.3 on all my sites” with one confirmation.
  • Site redirects. Create, update and delete a site’s redirects with POST, PUT and DELETE /api/v1/sites/{uuid}/redirections, with the same access rules as the dashboard. Legacy WordPress redirects stay on Site Rules.
  • Vulnerability scan settings. Turn a site’s vulnerability scan on or off with PUT /api/v1/sites/{uuid}/vulnerability-scan/settings. Turning it off now also removes the site from scheduled scans and from scan inventories, without deleting past findings.
  • WordPress versions you can install. GET /api/v1/catalog/wordpress-versions lists the versions site creation accepts, and the API validates against that same list.
  • Stricter filters. An unknown status or type filter on the site and server lists now answers 422 instead of a silently unfiltered list.

🆕 WireGuard Updates From the Dashboard

A WireGuard site shows its current and latest stable version and can queue a tracked update from the dashboard, the Public API or MCP. Only stable updates within the same major version are accepted; the update snapshots the client data and restores it if the new version does not come up healthy.

🔒 Security Improvements

  • Database management. Database and user names are validated and safely quoted in every database action, and grants are written so that a name with _ or % can never reach another database such as mysql.
  • Cloudflare “Block Sensitive File Access”. The rule now also blocks leftover wp-config copies, and its backup pattern only matches archive files, so normal site paths are no longer caught.
  • Telegram. Linking a chat now uses a single-use code and links only the chat you confirm.
  • Safer MariaDB installs. New servers install MariaDB 11.8. MariaDB 10 can no longer be chosen for a new server or a rebuild, while existing MariaDB 10 servers keep working. An install stops instead of finishing on a failed download or a version below the security fix, and the server pages show the exact MariaDB or MySQL version installed.
  • Checked custom Nginx rules. Custom Nginx rules saved by members with site-level access are checked before they are applied, including bulk apply, activation and site clones. Rules with unsupported directives, includes or unsafe paths are refused with a clear message. (Already live as a hotfix since 27 October.)
  • Secrets off the page. Password updates no longer leave the new password in task scripts.

✨ Improvements

  • A failed default-PHP switch says so. The dashboard, the Public API and the AI Assistant report the failure and keep the old default, instead of showing a success that did not happen.
  • n8n needs Node.js 24. Site creation refuses n8n below Node.js 24, and an n8n update is refused when the chosen version does not support the server’s Node.js. Node.js update checks clean dead apt sources first, so they no longer fail on retired PPAs.
  • Lighter PHP settings sync restarts only the PHP-FPM pools it has to.
  • Faster SSH Key page for teams with many sites.

🐛 Bug Fixes

  • Backups. The Previous Backups page shows a Backup in progress row the moment you click Backup Now, even for a site’s first backup, and the page refreshes itself when the backup finishes. A backup that failed, or whose report xCloud refused, no longer leaves the destination stuck on “running”.
  • WordPress updates. A core update row stuck on “Updating” after the update had landed is settled on the next scan.
  • Server deletes. Deleting a Vultr or Hetzner server whose instance the provider already removed now finishes instead of failing; Leaseweb servers outside the pool are deleted at Leaseweb instead of failing with “Invalid cloud provider”, and a server whose VPS is still in use is never terminated.
  • Mail Delivery. Removing the last Mail Delivery plan closes the Elastic Email subaccount and warns about sites that will stop sending; each domain publishes and verifies its own DKIM key.
  • Billing. Enterprise API Site Security Pro purchases work and bill the client team; a stored server resize runs after its invoice is paid, and the resize success email is sent again; the self-managed bill fixer selects custom servers; a white-label product SKU is checked within its own white label.
  • Firewalls and apps. OpenLiteSpeed 7G no longer blocks the xSpeed Database panel; LibreChat keeps writing its MongoDB data after install, domain change and Site Rescue; a WordPress multisite network survives a domain change; stale Cloudflare DNS records of a multisite are cleaned up.
  • Site SSH. A failed SSH change on the server is rolled back in xCloud, and key syncs are verified.

Please note

  • PostgreSQL is Nginx-only and needs Docker Engine 28 or newer. PostgreSQL sites cannot be cloned, migrated, staged or snapshotted yet, and their databases are not in site backups yet.
  • Discord and webhook notifications need a paid plan and are not yet available in the Public API, MCP or white-label dashboards.
  • n8n on a server with Node.js below 24 keeps running but cannot be updated until Node.js is updated.
  • Hide My WP custom Nginx preset can no longer be applied by members with site-level access only. A member who can manage the server’s settings can still apply it.