Book a demo
Book a demo
Login
NewImprovedFixed

v2.9.9.4

Delete a Failed Server and Get Your Payment Back as Account Credit

You can now delete a server that failed before it was ever set up, and what you paid for it is added to your Account Credit. API and MCP users can update only the vulnerable plugins, themes and WordPress core on many sites in one request. One-Click Apps also keep their passwords and keys safer.

🔥 New Features

🆕 Delete a Failed Server Yourself and Get Your Payment Back as Account Credit

Before, a server that failed during setup could not be deleted from your dashboard, and its bills kept renewing until support stepped in. Now you can delete it from its progress page, and the full amount you paid for it goes to your Account Credit.

Who it’s for: Anyone whose new server failed before it finished setting up.

  • The server’s progress page shows Delete when the server failed before its first setup and was created on or after May 19, 2026.
  • Servers on your own cloud provider account, and servers you connected yourself, can always be deleted this way. xCloud-managed servers can be deleted when they have no public IP yet.
  • A failed xCloud-managed server that already has a public IP shows Retry instead, then Contact Support.
  • The delete window says Any amount you paid for this server will be added to your Account Credit. You get back the full amount you paid for hosting and backups. Lifetime deals and addons are not included.
  • The server’s unpaid bills and its unpaid creation invoice are cancelled. A failed server’s bills no longer renew. If it finishes setup later, billing starts from that day.
  • If the server fails while its progress page is open, Delete and Retry appear without a page refresh.
  • Delete From Provider now stops when another server in xCloud uses the same machine at your provider, so you don’t remove a machine another server runs on. Turn it off to remove only the server from xCloud.
  • White-label teams can delete failed servers too, but they don’t get Account Credit.

🆕 Fix Known Vulnerabilities on Up to 100 Sites at Once

Before, fixing a known vulnerability in a plugin or theme meant opening each site or waiting for Auto Update. Now one request through the xCloud Public API or MCP updates only the vulnerable items, on up to 100 WordPress sites.

Who it’s for: API and MCP users, and agencies that manage many sites.

  • It updates only the plugins, themes and WordPress core with a known vulnerability. Everything else stays as it is.
  • You can pick the sites, or let it find every site in your team with a matching vulnerability.
  • A backup runs first by default. If the backup fails, nothing on that site is updated.
  • Run a dry run first to see what would change, then confirm.
  • You can follow its progress per site. A premium plugin that could not update is marked for a manual update.
  • The AI Assistant asks you to confirm before it runs the fix.

How to Fix Vulnerable Plugins, Themes and Core on Many Sites with the xCloud Public API and MCP

🧑‍💻 For Developers: Public API and MCP

  • Bulk vulnerability fix: POST /api/v1/vulnerabilities/fix (MCP tool vulnerabilities.fix) takes the same severity, source and include_ignored filters as GET /vulnerabilities, an optional sites list (up to 100), backup_before_update (default true), dry_run and confirm. Read per-site and per-finding results from GET /sites/bulk-operations/{uuid}; it needs the site:vulnerability-scan permission for this operation. How to Fix Vulnerable Plugins, Themes and Core on Many Sites with the xCloud Public API and MCP

🔒 Security

  • A One-Click App’s .env file, which holds its passwords and keys, can now be read only by the site’s own user. It stays that way after a permission reset or a domain change.
  • One-Click Apps with SSL now tell browsers to always use HTTPS. If the app or your custom Nginx config already sends this, yours is kept.
  • Archived servers can now only be deleted from Archive Servers, with the server name confirmation and every cleanup step. An older way to delete them that skipped these checks is gone.

⚡ Improvements

  • One-Click Apps
    • Some apps can now turn on Basic Auth during install. The Basic Auth User and Basic Auth Password show with the app’s other credentials.
    • More apps now come with their admin password already set when the install finishes, so you don’t have to create one on a setup screen first.

🐞 Bug Fixes

  • One-Click Apps
    • Installing an app no longer stops or removes another app on the same server.
    • Installs no longer stay stuck at 5% when server stats hadn’t updated yet.
    • Mautic now installs a version your server can run. If setup stops, the site now shows as failed with the reason, instead of showing as ready with only Mautic’s setup page.
  • Cloudflare
    • Changes in Cloudflare Security Settings, such as Block XML-RPC, now apply to the site’s additional domains too. Before, turning an option off left it blocking on those domains.
  • Sites
    • Changing a site’s domain now updates its custom Nginx configs to the new domain. Before, they kept the old domain and the change could fail.
  • Teams
    • Team members no longer go missing from Team Management when the team has pending invitations.
    • Settings → Customization now shows Access File Manager and Access Adminer to everyone allowed to change them, and only to them.