How to Set up Site Security PRO with xCloud
Updated November 5, 2026 · 12 min read
Site Security PRO Powered by Patchstack is an advanced WordPress vulnerability detection and protection system offered as an xCloud addon. It gives you proactive defense against security issues in plugins, themes, and core files, including early alerts, automated virtual patching, and real-time threat monitoring.
What You Get With Site Security PRO
Site Security PRO gives you precise, real-time vulnerability detection and automated virtual patching to protect your website from emerging threats. It helps you stay secure even when updates are unavailable, risky, or delayed.
- Automated Virtual Patching that protects against threats even if software isn’t updated yet.
- Earlier vulnerability alerts from Patchstack’s own research.
- Identifies exactly which plugin/theme versions are vulnerable.
- Shows whether an official patch is available.
- Shows how serious each vulnerability is and whether attackers can use it.
- Blocks the exact attacks known to target a vulnerability, instead of using general firewall rules.
- Protects sites even if you can’t update immediately.
- Protects when updates break functionality or require testing.
- Shows how to fix each vulnerability.
- Tracks changes and security events per site for internal records.
- Keeps a log of site activity and blocked attacks.
- A security dashboard that shows the attacks Patchstack blocked.
- Real-Time Monitoring & Alerts to catch exploit attempts as they happen.
Step 1: Open Patchstack From the Security Menu
Log into your xCloud dashboard and open the WordPress site you want to protect. In the left sidebar, click Security → Patchstack. Until Site Security PRO is active on the site, the Patchstack item carries a Pro badge.
Without the add-on, the page shows what Site Security PRO adds. It lists what you already get for free under Included now: Vulnerability Scan, such as the scan of WordPress core, plugins and themes, and what Adds with Site Security Pro: virtual patching, a firewall that logs and blocks attacks, hardening rules, earlier vulnerability alerts from Patchstack’s own research and a security dashboard. Click Open Vulnerability Scan to see the free scan results first.
💡 Note: Patchstack used to be reached from WordPress → Vulnerability Scan. It now has its own item in the Security menu, and the free scan stays under Security → Vulnerability Scan.
Step 2: Activate Site Security PRO
Click Activate Site Security Pro. The button row shows the price for the site. In the dialog, click the Pay now button (it shows the amount) to confirm your payment and complete the checkout. Activation runs in the background and can take a few minutes. xCloud opens Security → Patchstack, which shows Activating Site Security Pro… and updates by itself when it is ready.
You can also start the purchase from the Activate banner on Security → Vulnerability Scan, or buy the add-on for several sites from Addons → Site Security Pro in the dashboard, using Add New. If you already bought Site Security Pro in the cart but never applied it to a site, click Setup in Continue Addon Setup instead, so you don’t pay twice. See continue setup for purchased add-ons.
Step 3: Use the Patchstack Dashboard and Hardening Tabs
Once Site Security PRO is active, Security → Patchstack shows a header bar with the add-on’s status (Active), a Refresh button and a Deactivate button, and two tabs: Dashboard and Hardening. The Pro badge disappears from the menu.
Dashboard tab
Dashboard shows the Patchstack dashboard. Here, under the Vulnerabilities tab, you can see an overview of the total number of vulnerabilities, the number resolved, and the number of threats blocked.
Next, go to the Reports section under the Software tab to view the Status, Type, Component, Version, and Security information.
You can also enable auto-updates for Vulnerable Only, Core, Plugins, and Themes.
Next, go to the ‘Protection Modules’ tab to get an overview of the protection modules and how many threats have been blocked by the rules.
Hardening tab
Hardening adds extra protections for the site. Click Set as baseline on Basic, Recommended or Strict, review which controls will turn on and off, then click Set baseline. The change applies right away. Single controls you switch yourself, such as two-factor authentication or brute-force protection, need Save Changes. Controls you change yourself are kept when the baseline changes. CAPTCHA and IP rules are covered in Steps 7 and 8.
💡 Note: Hardening used to be the Advanced Hardening tab of WordPress → Vulnerability Scan. It is now a tab of Security → Patchstack.
Each baseline includes everything in the one before it. Custom login URL, CAPTCHA and the IP settings are not part of any baseline, so you set those yourself.
| Control | What it changes | First included in |
|---|---|---|
| Block readme access | Denies web access to readme.txt. | Basic |
| Block debug log | Denies web access to debug.log. | Basic |
| Block default files | Denies web access to wp-config.php and other core files. | Basic |
| Hide WordPress version | Removes the version from page output. | Basic |
| Disable file editor | Removes the theme and plugin code editor from wp-admin. | Basic |
| Security headers | Adds browser security rules to your site’s pages. This also tells browsers to open your site only over HTTPS for one year. xCloud can’t reverse that for visitors who have already opened your site. | Basic |
| Brute-force protection | Locks out an IP after repeated failed logins. | Recommended |
| Block user enumeration | Hides your usernames from public author links and lookups. | Recommended |
| Restrict XML-RPC | Only signed-in apps can use the older XML-RPC connection. This breaks Jetpack, the WordPress mobile app and remote publishing. | Recommended |
| Block application passwords | Disables WordPress application passwords. This breaks apps and integrations that sign in with one. | Recommended |
| Block fake bots | Blocks crawlers pretending to be Google or Bing. | Recommended |
| Restrict REST API | Requires a login for the WordPress REST API. This breaks headless front ends and guest WooCommerce checkout. | Strict |
| Two-factor authentication | Requires a second code at login. Each user must scan a QR code in their WordPress profile. Until then, they log in with a password only. | Strict |
| Stop image hotlinking | Stops other sites embedding your images. This may affect embeds you want. | Strict |
| Block proxy comments | Blocks comments posted through open proxies. | Strict |
| Custom login URL | Moves the login page to a path you choose and blocks wp-login.php. Use 5 to 40 letters, numbers or dashes. It must start with a letter or number and cannot contain common words like login or admin. Bookmark the new URL first. | Not in a baseline |
Step 4: Review Known Vulnerabilities in Vulnerability Scan
Open Security → Vulnerability Scan. With Site Security PRO active, it shows known vulnerabilities in WordPress core, your plugins and your themes, along with the security score, attacks blocked, and how many vulnerabilities were found and actively exploited. Below it, Security activity lists site activity and the attacks the firewall blocked. Click Refresh in the header to rescan. The scan runs in the background, and the results appear on the page when it finishes. Click each item for details and how to fix it.
If you have reviewed a vulnerability and accepted the risk, click Ignore on it. Ignored vulnerabilities are removed from the vulnerability count and are not included in vulnerability alert emails.
💡 Note: This list used to be the Advanced tab. It now opens directly from Security → Vulnerability Scan.
Step 5: Read Your Security Score and Raise It
The Security Score on Security → Vulnerability Scan rates the site’s protection out of 100 and gives it a grade: A from 90, B from 75, C from 60, D from 40, and F below that. The helper text under the number says how many points you are from an A and where most of them are. The numbers in the screenshots on this page are sample data.
| Score part | Points | How it is worked out |
|---|---|---|
| Protection running | 30 | 15 for the firewall being on, 10 for the plugin checking in within the last hour, and 5 for the plugin being active. |
| Vulnerability posture | 40 | Starts at 40. You lose 20 for each high-severity vulnerability, 10 for each medium, 4 for each low, and 2 for each outdated plugin, theme or core (up to 20). You lose 10 more if any is being actively exploited. |
| Hardening coverage | 30 | Up to 20 for the share of the 15 on/off controls in the Step 3 table (Custom login URL does not count) that are on, 5 for CAPTCHA on at least one form, and 5 for two-factor authentication. |
Vulnerability posture stays at 0 until the firewall is on, the plugin is active and Patchstack has listed the site’s software. An unknown result never counts as clean.
To raise the score:
- Fix anything shown next to the score first (see Step 6), because Protection running is worth 30 points.
- Update the plugins, themes and core listed under the score. Each fix returns points, and high-severity items return the most.
- Click Improve Score in Hardening, then turn on more controls. Check the warnings in the Step 3 table first, because a higher score is not worth breaking a plugin or integration your site needs.
- Add CAPTCHA to at least one form (Step 7) and turn on Two-factor authentication for up to 10 more points.
If you see Score is temporarily unavailable, xCloud could not reach Patchstack. Check back in a few minutes, or click Refresh in the header.
Step 6: Check Protection Health Warnings
The status next to the score tells you if protection is really running. Protection healthy means nothing needs action. Needs attention lists warnings, and Protection issue means the plugin is missing or off, so the site is unprotected.
| Message | What it means | What to do |
|---|---|---|
| The Patchstack plugin is not installed on this site. | The plugin is missing, so nothing connects the site to Patchstack. | If you see a Retry button on Security → Patchstack, click it. If it fails again, follow the failing to connect guide. If there is no Retry button, contact support. |
| The Patchstack plugin is deactivated | The site is unprotected. | Click Activate in the header. If you turned it off in wp-admin, activate it again under Plugins there, then click Refresh. |
| The firewall is turned off. | Attacks are not being inspected or blocked. | Open Security → Patchstack → Dashboard → Protection → Additional settings and turn Enable firewall back on and click Save settings. Within a few minutes, the status next to the score shows Firewall on and the warning clears. The auto-prepend firewall guide explains this setting. |
| No heartbeat from the plugin for over an hour. | The plugin has not checked in with Patchstack for over an hour. | Check that the site loads, then follow the failing to connect guide for anything blocking Patchstack. |
| The protection license expires soon. | The license ends within 14 days. | Check the subscription under Settings → Servers & Add-ons → Add-ons and your payment method. If it stays, contact support. |
Step 7: Add CAPTCHA to Your Forms
CAPTCHA stops bots on your login, registration, password reset and comment forms. You bring your own keys from Google reCAPTCHA or Cloudflare Turnstile, so create those first in your provider’s account.
Open Security → Patchstack → Hardening and find the CAPTCHA section. Choose a Provider: reCAPTCHA v2 checkbox, reCAPTCHA v2 invisible, reCAPTCHA v3 or Cloudflare Turnstile. Paste your Site key and Secret key.
Turn on the forms you want to protect (Login form, Registration form, Password reset, Comments), then click Save CAPTCHA. xCloud will not switch on a form until both keys are in place, so visitors can’t be locked out by a half-finished setup.
After saving, the secret key shows only its last characters. Leave that field blank to keep it, or type a new key to replace it. If the site already uses a provider xCloud does not manage, change it from the Patchstack dashboard, because saving here would overwrite its keys.
Step 8: Set Network and IP Rules
The Network and IP Access Control sections of the Hardening tab control how the firewall treats visitor addresses. Click Save Changes after editing them.
Visitor IP header tells the firewall where to read the real visitor IP. Keep the current setting unless the site sits behind a proxy. Direct connection — xCloud default is the option for a site with no proxy in front of it. If a proxy is in front, choose its option, such as Behind Cloudflare (CF-Connecting-IP) or Behind Sucuri. Otherwise the firewall may not see the real visitor address, so it can block the wrong one.
Firewall auto-block temporarily blocks an IP that trips the firewall repeatedly. Set Firewall hits (5 to 1,000), Within (min) (1 to 1,440) and Block for (min) (1 to 10,080).
Under IP Access Control, type an address in Blocked IPs and click Block to deny it on every request. You can enter one IP, a range such as 10.0.0.0/24, or a trailing wildcard such as 203.0.113.*. xCloud refuses a rule that would block every visitor.
Login allowlist exempts an IP from brute-force lockout. It does not restrict who can reach the login page, and listed IPs skip login rate limiting, so only add addresses you trust.
These controls work by IP address. The Hardening tab has no country rule. If you block countries elsewhere, such as in Cloudflare, keep the United States allowed so Patchstack can reach your site.
Deactivate or Activate It Again
Click Deactivate in the header bar to turn off the Patchstack plugin on the site. The firewall and virtual patching stop, and the page warns that the site is unprotected, until you click Activate again; the plugin keeps its settings. Deactivating does not end the subscription. To end it, click Remove under Settings → Servers & Add-ons.
How to Manage Your Patchstack Subscription
Manage From the Addons Page
Click Addons in the dashboard menu, then open Site Security Pro. The list shows each subscribed site with its status. Click Add New to subscribe another site, or use the menu under Actions to manage one.
Manage From Servers & Add-ons
Go to Settings → Servers & Add-ons and open the Add-ons tab. Under Site Security Pro, you can see each protected site, the date it was added and its status. Click Remove to end the subscription for a site.
Frequently asked questions
Which sites can use Site Security PRO?
WordPress sites only. A Custom PHP, Laravel, Node.js or other non-WordPress site does not appear in the site list when you add a subscription, because Patchstack protects WordPress core, plugins and themes. The site’s team also needs a paid xCloud plan to open Security → Patchstack.
Can I deactivate the Patchstack plugin in WordPress?
No, keep it active. The plugin is the connection between your site, Patchstack and xCloud. If you deactivate or delete it in wp-admin, the firewall stops. To pause protection, use the Deactivate button in xCloud instead, and click Activate when you are ready.
What if my domain was added to another Patchstack account?
If the domain was added to another Patchstack account, the connection may fail. Remove it there completely, then click Retry on Security → Patchstack.
What if my site already sets the same security headers?
If your site already sets these headers and you see problems after turning this on, turn off Security headers. The control is in the Information Exposure section of the Hardening tab. Click Save Changes after you turn it off. This also tells browsers to open your site only over HTTPS for one year. xCloud can’t reverse that for visitors who have already opened your site.
What is Site Security Pro?
Site Security PRO (formerly Vulnerability Shield PRO) is the renamed version of our advanced WordPress security add-on, powered by Patchstack. It blocks attacks on known WordPress vulnerabilities, even when the plugin or theme has no fix yet, using automated virtual patching.
Can I use Site Security PRO with other security plugins?
Usually, yes. As of November 2026, Patchstack says other security plugins can run next to it, but it can’t guarantee your site will run smoothly with several of them, and it advises against turning on the same feature twice, such as two-factor login. If Patchstack shows an error saying another security plugin’s firewall setting is still in place, follow the auto-prepend firewall guide. Avoid running a second copy of the Patchstack plugin.
Is it compatible with WordPress Multisite?
Contact support before adding Site Security PRO to a Multisite network.
Can I cancel anytime?
Yes. Go to Settings → Servers & Add-ons, open the Add-ons tab and click Remove next to the site.
How many sites can I buy Site Security PRO for?
As many as you want. Each site is billed separately, and the checkout shows the price before you pay.
Do I need a separate subscription for each site?
Yes. Each site needs its own subscription.
Why is Site Security PRO by Patchstack not connecting to my WordPress site?
Connection issues may occur due to Cloudflare settings, strict firewall rules, or other server restrictions. Read this documentation to restore the connection. After fixing the cause, click Retry on Security → Patchstack or Security → Vulnerability Scan. In the dialog, confirm that you followed the troubleshooting steps, then click Retry Activation.
What happens to Security Pro when I move my Demo site to Production?
xCloud moves the new domain to Patchstack for you, and you may see Updating domain while it runs. If protection does not show as Active afterwards, contact support.
If you run into any issues with Site Security PRO, feel free to reach out to our support team.