Book a demo
Book a demo
Login
NewImprovedFixed

v2.9.8.3

See What Needs You Across All Your Sites and Servers With the Security Center

The new Security Center shows your whole team’s security on one page. One vulnerable plugin on 40 sites is one line, and each line has one button that opens the page where you fix it. Security Update now also lists every major service on your servers and keeps Node.js patched.

🔥 New Features

🆕 Security Center: Your Team’s Security on One Page

Before, you had to check vulnerable sites, old PHP versions and waiting server patches on separate pages. Now Settings → Security Center brings them together. It replaces the old Vulnerable Sites page, and old links open the Security Center.

Who it’s for: Teams on a paid plan, especially agencies with many sites.

  • Overview. Four cards show Sites secure, Open vulnerabilities, Handled automatically and Servers to look at. Most affected plugins lists the plugins on the most sites.
  • What needs you. A plain list of the work, most urgent first, with one button per line, such as Update now, Apply or Plan upgrade.
  • Sites. By plugin shows each vulnerable plugin, theme or WordPress core once, with how many sites run it and whether a fix exists. A red Being exploited label marks a vulnerability attackers are using. By site lists every site with its vulnerabilities, PHP or Node.js version and protection.
  • Servers. Waiting Security Patches, reboots and end-of-life versions, for members who can manage server security.
  • Nothing runs by itself. Opening the Security Center only reads what xCloud already knows. Only Check now starts a vulnerability check. Every other button opens the page where you decide what to do.

Find and fix security issues with the Security Center. New to xCloud’s security tools? The WordPress security checklist shows what to turn on first.

🧑‍💻 For Developers: Public API and MCP

  • Security overview. GET /api/v1/security/overview returns what needs you, vulnerabilities grouped by plugin, theme or core, and each site’s status. It needs a token with the read:sites scope. The xCloud MCP server offers the same read-only overview as the security.overview tool.

⚡ Improvements

  • Security Update covers every major service, plus Node.js. The Security Update page now lists the installed services with Managed Service Updates on or off, and says why a service is left out. Node.js now gets its patch updates too, and only the apps still running the old Node.js are reloaded. The page is redesigned for light mode, dark mode and phones. How automated security updates work
  • Feedback moved to the Support Portal. The floating Feedback tab no longer covers side panels. You now find Feedback in the Support Portal menu.

🐞 Bug Fixes

  • SSL
    • Certificates that failed and expired more than 30 days ago are now marked renewal required once, instead of being retried every 15 days.
  • Sites
    • A database table prefix is now limited to 20 characters when you create a WordPress site. Longer prefixes broke WooCommerce.
  • Cloudflare
    • Set as default on a Cloudflare account works again.
    • Buying Cloudflare Enterprise for a domain is no longer blocked by an old, unpaid entry from another team.
  • Backups
    • Scaleway backups larger than about 8 GB no longer fail.
  • Servers