If you want to know how xCloud keeps your WordPress sites safe, it works in layers: xCloud protects the server and the network, and Site Security PRO protects the plugins, themes and core files inside each site. WordPress powers 43% of the web, which also makes it the most attacked platform. You did not do anything wrong to be a target.
Why firewalls and malware scans are not enough
Most hosting providers offer basic security: firewalls, malware scans and SSL certificates. Those matter, and xCloud has them. The outer layers (network firewalls, DDoS protection and SSL) defend against traffic-level attacks.
They have no answer for an attacker who exploits a vulnerability inside a legitimate plugin that is already running on your site. A plugin with a known vulnerability is an unlocked door inside an otherwise secure building. The perimeter defenses see nothing wrong, because the request looks legitimate.
This is where Patchstack comes in. It works at the application layer, one level deeper, and monitors the plugins, themes and core files that make up your WordPress site. When a vulnerability is identified, Patchstack deploys a mitigation rule: a targeted firewall rule that blocks exploitation of that specific weakness without changing your website or plugin code. This is called virtual patching.
How Site Security PRO protects your sites
xCloud partnered with Patchstack to build Site Security PRO into your xCloud dashboard. It gives you:
- Virtual patching that blocks known attacks even when a plugin update is not out yet, or when you cannot update right away.
- Earlier vulnerability alerts from Patchstack’s own research.
- A list of exactly which plugin and theme versions are vulnerable, how serious each issue is and whether a patch is available.
- A log of the attacks that were blocked on each site.
The timing matters. Patchstack’s State of WordPress Security in 2026 report puts the median time to mass exploitation of heavily exploited vulnerabilities at 5 hours, which can be faster than a plugin developer can ship a fix.
Site Security PRO works on WordPress sites only, and the team needs a paid xCloud plan to open Security → Patchstack. Read how to set up Site Security PRO for the dashboard, hardening and CAPTCHA options.
Results from the first 90 days
In the first 90 days after xCloud rolled out Site Security PRO across its platform, as reported in May 2026:
- 53,000+ threats blocked
- 300+ WordPress sites protected
These are xCloud platform figures from that period, not a guarantee for any one site.
See what needs attention in the Security Center
Protection works best when you can see what is waiting. The Security Center shows vulnerable plugins, old PHP and Node.js versions and waiting server patches across your sites and servers on one page, and each line opens the page that fixes it. The Vulnerability Scan feeds it with the plugins and themes on your sites that have known problems.
For agencies and freelancers: add security to client plans
If you manage WordPress sites for clients, Site Security PRO gives you something concrete to show. “We keep your plugins updated” is hard for clients to see. A record of blocked attacks is easier to explain.
- Bundle it into your retainer. At $2 per site per month, it is a small cost to add to a maintenance plan.
- Use the data in client reports. Your blocked-attack log lets you say what was stopped on a client’s site, not only that backups ran.
- Use it in your pitch. Tell new clients their hosting includes vulnerability protection from Patchstack.
For ready-made monthly reports, see the agency guide to website maintenance reports.
How to turn on Site Security PRO
- Open your site in the xCloud dashboard and go to Security → Patchstack.
- Click Activate Site Security Pro.
- In the dialog, click Pay now to confirm the payment. Activation runs in the background.
To subscribe several sites at once, open Addons → Site Security Pro and click Add New.
The price is $2 per site per month. It was reduced from $5 for a limited time, and existing subscribers keep the $2 rate. Activate Site Security PRO or read the setup guide.
Frequently asked questions
What is Site Security PRO?
Site Security PRO is an xCloud addon powered by Patchstack. It watches your WordPress core, plugins and themes for known vulnerabilities and blocks attacks on them with virtual patches.
Does Site Security PRO work on sites that are not WordPress?
No. Patchstack protects WordPress core, plugins and themes, so Custom PHP, Laravel, Node.js and other non-WordPress sites cannot subscribe.
How much does Site Security PRO cost?
It is $2 per site per month. The price was reduced from $5 for a limited time, and existing subscribers keep the $2 rate.
Do I still need to update my plugins?
Yes. A virtual patch blocks attacks on a known weakness while you wait for the developer’s fix. Keep updating plugins and themes as usual.
Site Security PRO is powered by Patchstack, a WordPress vulnerability detection and mitigation platform.
Last updated November 5, 2026
← All articles