# See what needs you across your sites and servers with the Security Center in xCloud

> Use the xCloud Security Center to see vulnerable plugins, old PHP and Node.js versions and waiting server patches on one page, then open the page that fixes each one.

The xCloud **Security Center** shows what needs you across your sites and servers on one page. One vulnerable plugin on 40 sites is one line, and each line has one button that opens the page where you deal with it. It replaces the old **Vulnerable Sites** page, and old links to that page now open the Security Center.

The Security Center reads what xCloud has already stored: results from each server's [Vulnerability Scan](/docs/vulnerability-checker-in-xcloud/), Site Security Pro findings, PHP and Node.js versions, and each server's [Security Updates and Security Patches](/docs/how-automated-security-updates-and-auto-reboot-work-in-xcloud/). Opening it runs nothing on your servers.

## Before you start

- You need a paid plan. On the free plan, opening the Security Center takes you to your billing page with the message "You need to upgrade your plan to access this feature."
- WordPress vulnerabilities only appear for sites the server's **Vulnerability Scan** covers. See [Vulnerability Checker](/docs/vulnerability-checker-in-xcloud/) to turn it on.
- You see only the sites and servers your team role gives you. See [Who sees what](#who-sees-what).

## Step 1: Open the Security Center

Click **Settings** in the main menu, then click **Security Center**. The group opens with three pages: **Overview**, **Sites** and **Servers**.

![Click 'Security Center' in the Settings menu to open Overview, Sites and Servers](/_landing/docs/find-and-fix-security-issues-with-xcloud-security-center-image-1.png)

## Step 2: Read the four cards on Overview

The four cards at the top of **Overview** give you the team's position at a glance:

- **Sites secure**: sites with no known vulnerability, an up-to-date PHP or Node.js version and, for WordPress, a recent check.
- **Open vulnerabilities**: how many vulnerabilities are open, on how many sites, how many are new this week, and the split by severity.
- **Handled automatically**: the share of vulnerable sites that have **Auto Update** or **Site Security Pro**.
- **Servers to look at**: servers with a Security Patch waiting, a reboot needed or an end-of-life version. Members without access to server security don't see this card.

![The Sites secure, Open vulnerabilities, Handled automatically and Servers to look at cards on Overview](/_landing/docs/find-and-fix-security-issues-with-xcloud-security-center-image-2.png)

Below the cards, **Most affected plugins** lists the plugins on the most sites. The **Open vulnerabilities** chart shows the last 30 days, with counts for **Fixed by Auto Update**, **Security Patches applied** and **Update runs**. You see the chart and these counts only if you can access every server in the team. It records one point a day, so a fix shows on the chart from the next day's point.

## Step 3: Work through What needs you

**What needs you** lists the work in plain sentences, the most urgent first. Each line has one button. When the list is empty, it says **Nothing needs you right now**.

![The What needs you list on Overview, with one button on each line](/_landing/docs/find-and-fix-security-issues-with-xcloud-security-center-image-3.png)

| Line says | Button | What the button does |
|---|---|---|
| A plugin has a critical vulnerability, or one attackers are using | **Update now** | Opens the **Updates Manager**, filtered to that plugin. Without permission to update sites, the button is **See sites**. |
| More plugins have a critical vulnerability | **Review** | Lists them on **Sites** |
| A plugin has a vulnerability with no fix yet | **See options** | Opens that plugin on **Sites**, with the option to protect its sites |
| More plugins have no fix yet | **Review** | Lists them on **Sites** |
| A server needs a Security Patch | **Apply** | Lists the servers waiting for one on **Servers** |
| A server needs a reboot | **Reboot** | Lists those servers on **Servers** |
| Node.js is missing a security update | **Update** | Lists those servers on **Servers** |
| Node.js has not been checked for a fix | **Check** | Lists those servers on **Servers** |
| Sites run an end-of-life version | **Plan upgrade** | Lists those sites on **Sites**, with their fix buttons |
| Sites have not been checked in the last 3 days | **Check now** | Starts a vulnerability check of your sites |
| Servers don't update vulnerable plugins automatically | **Turn on Auto Update** | Lists those servers on **Servers** |

Only **Check now** starts anything from this page. Every other button opens a page where you decide what to do.

## Step 4: Fix one plugin on every site that runs it

Click **Sites**, then **By plugin**. Each vulnerable plugin, theme or WordPress core appears once, with its severity, the number of sites and one of three statuses:

- **Update available**: a fixed version exists. **Update now** opens the **Updates Manager**, which can back each site up first.
- **No fix yet**: no fixed version exists. Deactivate the plugin if you can, or protect the sites with Site Security Pro until a fix ships.
- **Handled automatically**: **Auto Update** is on for every affected site, so it updates within 24 hours.

A red **Being exploited** label means attackers are using this vulnerability. Click a row to see the advisory, the fixed version and every affected site with its server, installed version and protection.

![An open row on the By plugin view, showing the fixed version and each affected site](/_landing/docs/find-and-fix-security-issues-with-xcloud-security-center-image-4.png)

Search by plugin or site name, and filter by status or by severity (**Critical or exploited**, **Lower risk**).

## Step 5: Check each site

Click **By site** to list every site, WordPress or not. Each row shows:

- **Vulnerabilities**: the count, with **Install N updates** when updates are ready. It opens that site's updates page.
- **Runtime**: the PHP or Node.js version and its status: **Security update available**, **End of life** or **Up to date**. **Update PHP** or **Update Node.js** appears when the version needs work.
- **Protection**: **Site Security Pro** and **Auto Update**. **Auto Update** only shows as on for sites the server's scan covers.
- **Last checked**: when the site was last checked. It can also say **Never checked**, **Last check failed** or **Scan off**.

![The By site view, with Update PHP marked in the Runtime column](/_landing/docs/find-and-fix-security-issues-with-xcloud-security-center-image-5.png)

Filter by site type (**PHP apps**, **Node.js apps**, **Docker apps**) or by state: **Needs attention**, **With vulnerabilities**, **Runtime needs an update**, **Not checked recently**, **Not tracked yet** or **No Site Security Pro**. Docker apps show **Not tracked yet**, because xCloud has no security data for them.

When WordPress sites have no Site Security Pro, a banner offers it. See [How to Set up Site Security PRO with xCloud](/docs/set-up-site-security-pro/).

## Step 6: Check your servers

Click **Servers**, the third page in the **Security Center** group. Each server has one status: **Security Patch waiting**, **Node.js security update**, **Node.js not checked**, **Reboot needed**, **End of life** or **Up to date**. **+N more** means the server has other items too. **Protection** counts what is on, such as **2 of 4 on**. The four are **Auto Update**, **Auto Backup**, **PHP, database and Redis updates** and **Automatic reboot**.

Click a server to see what needs attention, its protection and its versions.

- **Open Security Update** and **Change Security Update** open the server's **Security Update** page.
- **Change Auto Update** opens the server's **Vulnerability Settings**.

For an example of a waiting patch, see [Apply the MariaDB Security Patch in xCloud](/docs/apply-the-mariadb-security-patch-in-xcloud/).

## Step 7: Change what the scan covers on a server

Open a server, then click **Security** → **Vulnerability Settings**. Turn on **Vulnerability Scan**, choose what **Scan covers**, then click **Save Settings**.

![Scan covers on a server's Vulnerability Settings page](/_landing/docs/find-and-fix-security-issues-with-xcloud-security-center-image-7.png)

The full steps are in [Vulnerability Checker](/docs/vulnerability-checker-in-xcloud/).

## Step 8: Move a site off an old PHP version

**Update PHP** opens the site's settings at **PHP Configurations**. If the version no longer gets security fixes, a notice says so and names the version to move to. Click **Choose PHP 8.3** (or the version it names), then **Save Settings**. Nothing changes until you save. If the site runs old plugins, try the new version on a staging site first.

![Choose PHP 8.3 in the notice on a site's PHP Configurations card](/_landing/docs/find-and-fix-security-issues-with-xcloud-security-center-image-8.png)

If the server cannot install a newer PHP version, the notice offers **Clone this site to a newer server** instead.

## Step 9: Update Node.js on a server

**Update Node.js** opens the server's **Node Configuration** page. Click **Check for updates** to see whether the server has the fixed version. If it does not, click **Update Node.js**. Running apps reload with the new version.

![Check for updates on the server's Node Configuration page](/_landing/docs/find-and-fix-security-issues-with-xcloud-security-center-image-9.png)

## Who sees what

| Team role | Overview and Sites | Servers |
|---|---|---|
| Team Admin | The sites their access covers | The servers their access covers |
| Server Admin | The sites their access covers | The servers their access covers |
| Site Admin | The sites their access covers | Not shown |

A member also needs the team's vulnerability scan permission to open the Security Center, and a server security permission to see **Servers**. Fix buttons follow the permissions people already have. For example, **Update PHP** needs permission to change site settings. See [Team Roles & Permissions in xCloud](/docs/team-roles-permissions-in-xcloud/).

On a white-label account, the Site Security Pro offer doesn't appear.

## For developers: Public API and MCP

- `GET /api/v1/security/overview` returns what needs you, vulnerabilities grouped by plugin, theme or core, and each site's status. It needs a token with the `read:sites` scope, and it names sites and servers by UUID.
- Servers are included only for a token with the `read:servers` scope, held by a Team Admin or Server Admin with a server security permission.
- Optional filters are `status` (`all`, `update_available`, `no_fix`, `handled_automatically`), `urgent`, `type` (`all`, `core`, `plugin`, `theme`) and `kind` (`all`, `wordpress`, `php`, `node`, `app`).
- The xCloud MCP server offers the same read-only overview as the `security.overview` tool. See [How to Connect xCloud MCP to an AI Agent](/docs/how-to-connect-xcloud-mcp-to-ai-agent/).

## Frequently asked questions

### Does the Security Center scan my sites or change anything on my servers?

Opening it does not. It shows what xCloud has already stored: the results of each server's Vulnerability Scan, Site Security Pro findings, the PHP and Node.js versions behind your sites, and each server's patches and updates. Check now starts a vulnerability check of your sites. Every fix button only opens the page that makes the change.

### Why does a WordPress site show Never checked or Scan off?

Scan off means the server's Vulnerability Scan is off or does not cover that site. Never checked means the scan covers the site but no check has finished yet. A site that has not been checked is never counted as secure. Open the server's Vulnerability Settings page to change what the scan covers.

### Why does a Docker app say Not tracked yet?

xCloud has no security data for Docker apps yet. They are listed without a status instead of being counted as secure.

### Can I use the Security Center on the free plan?

No. On the free plan, opening it takes you to your billing page with the message "You need to upgrade your plan to access this feature."

If you run into any issues, feel free to reach out to our [support team](/docs/access-built-in-support-portal-in-xcloud/).