Requirements and responsibilities
Have the schools owner approve public copy, required staff roles and the exact sample journey. A school needs public announcements but private student work belongs elsewhere.
xCloud agent capability boundaries · WordPress roles and capabilities
Use a compatible Nginx or OpenLiteSpeed stack for native WordPress. Verify current server resources, plan eligibility and each selected plugin or service license and requirements before installing; a Docker server does not host a new native WordPress site.
xCloud agent capability boundaries · WordPress plugin administration
Prepare a safe test identity and a completed, accessible backup before consequential changes. The important failure to plan around is: Exposing student information in a marketing site is a preventable design error.
Approve form fields and readership with the organization; keep sensitive client, patient, student or account records in its authorized system. Hosting availability does not establish sector compliance.
WordPress roles and capabilities · WordPress hardening handbook
Illustrative situation
Illustrative scenario, not a customer case study: A school needs public announcements but private student work belongs elsewhere. A public visitor sees announcements while staff-only drafts stay private.
Choose the approach
Separate public WordPress publishing from student accounts and records. Verify the selected provider or plugin documentation and license against this requirement; xCloud hosting does not supply its business configuration.
xCloud agent capability boundaries · xCloud MCP documentation and connection profiles · WordPress roles and capabilities
Keep application setup, domain/DNS ownership, mail delivery and external integrations with their named administrators. Use a plain documented path when a proposed integration cannot be demonstrated end to end.
xCloud agent capability boundaries · WordPress plugin administration
Dashboard and application procedure
Follow these steps yourself, or use the scoped AI handoff below for supported hosting operations.
Step 1 of 5
Define public audience, approvers and information exclusions
- Where
- WordPress or selected application administrator and public test browser
- Permissions
- Named WordPress or selected application administrator; business owner accepts result.
- Inputs
- Define public audience, approvers and information exclusions; named administrator and a harmless representative sample.
- Action
- Separate public announcements from private student records and name a school reviewer for calendars, photos and staff information.
- Expected result
- The public site's data boundary is approved.
- Verify
- The public site's data boundary is approved. Have the responsible business staff member record the sample identity and observed result.
- If it fails
- If a proposed page exposes student details, move it to an approved school system.
Sources: WordPress roles and capabilities · WordPress plugin administration
Step 2 of 5
Create WordPress pages and least-privilege staff roles
- Where
- WordPress or selected application administrator and public test browser
- Permissions
- Named WordPress or selected application administrator; business owner accepts result.
- Inputs
- Create wordpress pages and least-privilege staff roles; named administrator and a harmless representative sample.
- Action
- Create WordPress pages for admissions, calendar and notices with administrator and contributor roles aligned to staff duties.
- Expected result
- Visitors can find current public information.
- Verify
- Visitors can find current public information. Have the responsible business staff member record the sample identity and observed result.
- If it fails
- If contributors can publish without review, correct roles before inviting more staff.
Sources: WordPress roles and capabilities · WordPress plugin administration
Step 3 of 5
Publish calendar and announcement workflow
- Where
- WordPress or selected application administrator and public test browser
- Permissions
- Named WordPress or selected application administrator; business owner accepts result.
- Inputs
- Publish calendar and announcement workflow; named administrator and a harmless representative sample.
- Action
- Set a draft and review path for announcements, including expiry dates and contact for corrections.
- Expected result
- A new notice can be approved without sharing administrator access.
- Verify
- A new notice can be approved without sharing administrator access. Have the responsible business staff member record the sample identity and observed result.
- If it fails
- If a notice has no owner or expiry, keep it in draft.
Sources: WordPress roles and capabilities · WordPress plugin administration
Step 4 of 5
Test draft visibility, archive dates and mobile notices
- Where
- WordPress or selected application administrator and public test browser
- Permissions
- Named WordPress or selected application administrator; business owner accepts result.
- Inputs
- Test draft visibility, archive dates and mobile notices; named administrator and a harmless representative sample.
- Action
- Have a contributor draft a sample closure notice and an editor publish it; inspect the mobile view, date and visibility to signed-out visitors.
- Expected result
- The current notice is public while unapproved drafts remain private.
- Verify
- The current notice is public while unapproved drafts remain private. Have the responsible business staff member record the sample identity and observed result.
- If it fails
- If drafts leak or dates use a wrong timezone, fix before relying on alerts.
Sources: WordPress roles and capabilities · WordPress plugin administration
Step 5 of 5
Assign term rollover, access review and recovery owner
- Where
- WordPress or selected application administrator and owner handoff
- Permissions
- Named WordPress/application administrator and business owner; inspect backup separately if recovery is in scope.
- Inputs
- Assign term rollover, access review and recovery owner; named administrator and a harmless representative sample.
- Action
- At term rollover, archive old notices, review leaver accounts and verify backup includes media and public pages.
- Expected result
- The new term starts without stale contacts.
- Verify
- The new term starts without stale contacts. Have the responsible business staff member record the sample identity and observed result.
- If it fails
- If a restore point predates a closure notice, republish it after recovery.
Sources: WordPress roles and capabilities · WordPress plugin administration
Maintenance
Assign a cadence for selected WordPress core, theme and plugin updates, review version-based findings and retest the path in this guide. In particular, repeat: A public visitor sees announcements while staff-only drafts stay private. A chat prompt is not a scheduled task.
Manage WordPress updates with Updates Manager · Vulnerability Checker in xCloud
Record actual backup completion, storage access and responsible staff. Recheck connected application and provider behavior after changes rather than relying on a site health status alone.
Recovery decisions
Before restoring, compare the chosen recovery point with newer business records. Exposing student information in a marketing site is a preventable design error. Use the xCloud dashboard for native restore only after the owner approves target and scope; reconcile or preserve newer data first.
Validate the restored copy with representative content, authentication, HTTPS and this guide’s business acceptance test before moving traffic or closing the incident.
AI handoff
Connect xCloud MCP through the current documented profile and grant only the scopes needed for the selected team. Discover tool schemas first. Read resources to plan; require approval for any supported write. Use returned dashboard URLs for manual work. The packaged REST wrapper accepts GET requests only.
Supported scope
- Confirm requirements and inspect resources mcp · read
Discover the connected profile and operation schema first; only teams granted to the connection are visible.
Checkpoint: Confirm exact team, server and site identity. Use dashboard_url returned by the resource; do not invent a dashboard link.
Operation identifiers and scopes to discover
teams.index, servers.show, sites.show
Scopes: read:servers, read:sites
xCloud MCP documentation and connection profiles · xCloud agent capability boundaries
- Review a WordPress business journey app · manual
Application data and observed transactions cannot be inferred from xCloud resource reads. Use authorized test accounts and the application or provider evidence.
Checkpoint: Record the test identity, timestamp, expected outcome, observed result and owner decision.
- Configure WordPress content, users and selected plugins app · manual
Requires a named WordPress administrator or suitable editor. Plugin behavior, commercial license, payment, email and external integration are verified in the chosen vendor documentation and application; xCloud hosting or MCP reads do not configure them.
Checkpoint: Open the actual WordPress or selected plugin interface, record the version and role, and have the business owner accept a real user journey.
WordPress roles and capabilities · WordPress plugin administration
Copyable agent brief
Manual checkpoints
- The named WordPress, app, dashboard or provider administrator performs the guide’s actual configuration step: Set a draft and review path for announcements, including expiry dates and contact for corrections.
- The business owner compares the controlled sample with this observable result: The current notice is public while unapproved drafts remain private.
- Staging push/pull, native backup schedules, restores and cache-setting edits require the authorized xCloud dashboard operator; the packaged REST wrapper is GET-only.
Feature coverage
- business-acceptance (covered): A public visitor sees announcements while staff-only drafts stay private. Test draft visibility, archive dates and mobile notices
- recovery (covered): Exposing student information in a marketing site is a preventable design error. Assign term rollover, access review and recovery owner