Enhancing Server and Website Security with xCloud

xCloud secures your websites by default, locking down servers during the provisioning process. However, it’s important to maintain good security practices and assist clients in doing so to further enhance security.

This documentation details the security measures xCloud implements by default, allowing you to create a comprehensive security checklist for setting up new websites on xCloud.

Want to know what to turn on first? Follow the WordPress security checklist, which puts the tools below in order, starting with two-factor sign-in.

xCloud’s Network and Server Security

1. SSH Lockdown

The root user is restricted to secure SSH access only to minimize the risk of unauthorized access.

2. SSH Key Authentication Recommended

SSH Key Authentication is more secure than password-based authentication, supporting public and private key authentication.

3. System User Isolation

System users created via our platform are completely isolated and secure from one another, each with only the essential permissions assigned.

4. Managing Server Access: Sudo Users vs. Site Users

In xCloud Sudo users have full server-wide access, allowing them to control all aspects of the server. In contrast, site users are restricted to managing a single site on the server, ensuring they cannot access or modify other sites’ files or server configurations.

5. Firewall Control – Linux UFW Configuration

At xCloud, the Linux Uncomplicated Firewall is configured during the server provisioning process.

6. Strict Port Control

By default, only essential ports are open (22/TCP for SSH, 80/TCP for HTTP, and 443/TCP for HTTPS), reducing attack risks. Users can also change the default port if needed.

7. Fail2Ban Preconfigured

Fail2Ban, an intrusion prevention software, is enabled on xCloud by default to protect against brute-force attacks on the SSH port. This is the server’s own Fail2Ban service, managed from the server’s Security settings. It is separate from WordPress login protection, which BetterShield now provides per site.

xCloud’s WordPress Security

1. Secure PHP Version

By default, new WordPress websites are provisioned with the most current version of PHP, ensuring compatibility and security.  

2. Latest WordPress Version

New websites created by any user employ the latest WordPress version to avoid unpatched vulnerabilities.

3. Disable Directory Browsing/System File Protection

xCloud prevents access to critical WordPress files and directories.

4. Disable PHP Execution in Uploads and Themes Directories

xCloud blocks maliciously uploaded PHP files in WordPress directories. The PHP Execution on Upload Directory setting on the site’s security page stays locked off.

5. SFTP and SSH Access Only

xCloud enforces the use of secure server connections exclusively via SFTP and SSH.

Site security in the Security menu

WordPress, Laravel, PHP, Node.js and other standard sites have a Security menu in their left sidebar that collects the site’s security pages in one place. Which items appear depends on the site type and your permissions: the WordPress-only tools show on WordPress sites, and an item is hidden when your team role does not include it. One-Click App template sites that serve a website keep Nginx and Security, IP Management and Basic Authentication under Tools.

Menu item	What you manage there
Overview & Firewall	An overview of what protects the site, the 7G and 8G firewalls, XML-RPC, X-Frame-Options, the X-XSS-Protection header, login protection, the AI Bot Blocker and, for sites on Cloudflare, Cloudflare’s security rules
Vulnerability Scan	WordPress core, plugin and theme versions with known vulnerabilities
Patchstack	Site Security Pro, powered by Patchstack: virtual patching, its dashboard and hardening
Integrity Monitor	Checksum checks of WordPress core and plugin files
IP Management	IP addresses to blacklist or whitelist for the site
Basic Authentication	A username and password in front of the whole site

1. Overview & Firewall

The top of Security → Overview & Firewall shows at a glance whether the web firewall, login protection, the vulnerability scan, Patchstack, the AI Bot Blocker and Cloudflare rules are on. Below it, the Security Settings card turns on the 7G or 8G firewall, which block malicious requests, bad bots and spam referrers, and controls Enable XML-RPC (keep it off unless Jetpack or the WordPress mobile apps need it), Edit X-Frame-Options and Remove X-XSS-Protection header, which stops the site sending a header current browsers no longer use.

2. WordPress login protection with BetterShield

The WP Fail2Ban & Login Protection card on the same page turns on BetterShield, a free plugin that limits failed logins, adds two-factor sign-in and passkeys, and bans repeat attackers at the server firewall. It replaces the WP Fail2Ban plugin, which xCloud no longer supports. Sites that still run WP Fail2Ban can switch in one step: see how to migrate from WP Fail2Ban to BetterShield.

3. AI Bot Blocker and Cloudflare rules

The AI Bot Blocker stops known AI crawlers and scrapers, with your own allow and block lists. For sites behind Cloudflare, the page also manages Cloudflare’s security rules and Under Attack Mode.

4. Vulnerability Scan and Patchstack

The Vulnerability Scan, on paid plans, lists WordPress core, plugin and theme versions with known security issues, and you can configure automatic updates to handle them. Site Security Pro, powered by Patchstack, goes further: it blocks attacks on known vulnerabilities even before a fix exists. Activate it from Security → Patchstack, where its Dashboard and Hardening tabs then live.

5. Integrity Monitor, IP Management and Basic Authentication

Integrity Monitor verifies WordPress core and plugin files against their official checksums. IP Management blocks or allows specific addresses, and Basic Authentication puts a password in front of a staging or private site.

Additional WordPress security options

1. Security Headers

Customize security headers to prevent cross-site scripting and clickjacking.

2. Website Isolation Through System Users

Assign unique system users to websites to keep them isolated and prevent cross-infection in case of a compromise.

3. 1 Click SSL Certificates

Users are encouraged to use SSL certificates for enhanced security. With just one click, SSL certificates can be implemented in xCloud.

Product Security

1. Two-Factor Authentication (2FA) on account

It is highly recommended for password-based authentication, requiring a second form of identification. See Two-Factor Authentication: Set It Up, and Recover Access If You Lose Your Device for setup, recovery codes, and what to do if you lose your device.

2. Permission Levels

Different permissions can be assigned to users or teams within the xCloud dashboard including server/site access, billing, user data, and message permissions.

3. Password and Credential Storage

xCloud enforces a complex password standard, storing credentials in hash form to reduce the risk of password theft and unauthorized access.

4. Credit Card Information

Payments are handled by the payment gateway (Stripe), ensuring no access to your credit card information.

5. Best Practices

Automated server configuration follows industry best practices for securing your server or web applications.

Still, facing any security issues? Contact our support team for any of your queries.