Requirements and responsibilities
Have named ownership of the domain, selected xCloud team and site, and WordPress administrator access. For this scenario, agree who supplies the data and signs off: An owner asks whether paid Site Security PRO is useful for a vulnerable site.
xCloud agent capability boundaries · WordPress roles and capabilities
Use a compatible Nginx or OpenLiteSpeed stack for native WordPress. Verify current server resources, plan eligibility and each selected plugin or service license and requirements before installing; a Docker server does not host a new native WordPress site.
xCloud agent capability boundaries · WordPress plugin administration
Prepare a safe test identity and a completed, accessible backup before consequential changes. The important failure to plan around is: Virtual patching can reduce exposure without repairing plugin code.
Illustrative situation
Illustrative scenario: a WordPress site has a version-based plugin finding. Its owner asks whether paid Site Security PRO is eligible and useful. This evaluation ends with a documented recommendation and unresolved risk; it does not enable protection or repair code.
Choose the approach
Compare software update, temporary PRO mitigation, disable and removal against the affected component and plan eligibility. Virtual patching is not the same as updating vulnerable plugin code.
Site Security PRO setup and eligibility · Vulnerability Checker in xCloud
Keep application setup, domain/DNS ownership, mail delivery and external integrations with their named administrators. Use a plain documented path when a proposed integration cannot be demonstrated end to end.
xCloud agent capability boundaries · WordPress plugin administration
Dashboard and application procedure
Follow these steps yourself, or use the scoped AI handoff below for supported hosting operations.
Step 1 of 5
Identify site entitlement and specific finding
- Where
- WordPress public/admin views and relevant provider evidence
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- Identify site entitlement and specific finding; exact site identity, named approver and controlled sample data.
- Action
- Identify the exact vulnerable component and Site Security PRO entitlement for the selected site without changing settings.
- Expected result
- The evaluation has a specific finding and eligibility.
- Verify
- The evaluation has a specific finding and eligibility. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- If entitlement is unknown, ask the account owner before planning paid protection.
Sources: WordPress roles and capabilities · Site Security PRO setup and eligibility · Vulnerability Checker in xCloud
Step 2 of 5
Read pro feature and licensing documentation
- Where
- WordPress public/admin views and relevant provider evidence
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- Read pro feature and licensing documentation; exact site identity, named approver and controlled sample data.
- Action
- Read current xCloud PRO documentation for virtual patching scope and paid requirements, then read the vendor's fixed-version path.
- Expected result
- The owner sees which problems PRO may mitigate.
- Verify
- The owner sees which problems PRO may mitigate. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- If a feature is not documented for this plan, do not promise it.
Sources: WordPress roles and capabilities · Site Security PRO setup and eligibility · Vulnerability Checker in xCloud
Step 3 of 5
Compare update, mitigation and removal options
- Where
- WordPress public/admin views and relevant provider evidence
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- Compare update, mitigation and removal options; exact site identity, named approver and controlled sample data.
- Action
- Compare update, temporary mitigation, disable and remove options against business impact and available test time.
- Expected result
- The decision separates code remediation from protection layer.
- Verify
- The decision separates code remediation from protection layer. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- If software can be safely updated, do not treat mitigation as permanent repair.
Sources: WordPress roles and capabilities · Site Security PRO setup and eligibility · Vulnerability Checker in xCloud
Step 4 of 5
Draft a separately approved PRO change
- Where
- WordPress public/admin views and relevant provider evidence
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- Have administrator configure eligible protection in dashboard; exact site identity, named approver and controlled sample data.
- Action
- Draft the proposed dashboard configuration and verification checks for an authorized administrator; do not enable PRO in an evaluation-only task.
- Expected result
- A later change can be approved with exact site and cost.
- Verify
- A later change can be approved with exact site and cost. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- If approval or license is absent, leave the setting unchanged.
Sources: WordPress roles and capabilities · Site Security PRO setup and eligibility · Vulnerability Checker in xCloud
Step 5 of 5
Record recommendation and repair deadline
- Where
- WordPress public/admin views and relevant provider evidence
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- Verify status and retain a software update deadline; exact site identity, named approver and controlled sample data.
- Action
- Record recommendation, residual risk and a deadline to update affected code. Keep the finding open until the selected software repair is verified.
- Expected result
- Evaluation ends with a concrete owner decision.
- Verify
- Evaluation ends with a concrete owner decision. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- If no option is acceptable, escalate the open finding rather than declaring the site safe.
Sources: WordPress roles and capabilities · Site Security PRO setup and eligibility · Vulnerability Checker in xCloud
Maintenance
Assign a cadence for selected WordPress core, theme and plugin updates, review version-based findings and retest the path in this guide. In particular, repeat: The team records what protection was enabled and what remains vulnerable. A chat prompt is not a scheduled task.
Manage WordPress updates with Updates Manager · Vulnerability Checker in xCloud
Record actual backup completion, storage access and responsible staff. Recheck connected application and provider behavior after changes rather than relying on a site health status alone.
Recovery decisions
This is an evaluation. No Site Security PRO settings or WordPress code are changed; retain the current finding and document the approved future remediation path. A virtual patch is not a software update.
Site Security PRO setup and eligibility · Vulnerability Checker in xCloud
AI handoff
Connect xCloud MCP through the current documented profile and grant only the scopes needed for the selected team. Discover tool schemas first. Read resources to plan; require approval for any supported write. Use returned dashboard URLs for manual work. The packaged REST wrapper accepts GET requests only.
Supported scope
- Confirm requirements and inspect resources mcp · read
Discover the connected profile and operation schema first; only teams granted to the connection are visible.
Checkpoint: Confirm exact team, server and site identity. Use dashboard_url returned by the resource; do not invent a dashboard link.
Operation identifiers and scopes to discover
teams.index, servers.show, sites.show
Scopes: read:servers, read:sites
xCloud MCP documentation and connection profiles · xCloud agent capability boundaries
- Review a WordPress business journey app · manual
Application data and observed transactions cannot be inferred from xCloud resource reads. Use authorized test accounts and the application or provider evidence.
Checkpoint: Record the test identity, timestamp, expected outcome, observed result and owner decision.
Copyable agent brief
Manual checkpoints
- The named site, business or provider owner supplies application evidence the connected hosting reads cannot observe.
- A separately approved operator performs any later configuration, staging, update, restore or publication described in the decision sheet.
- The owner accepts the review finding and proposed checks without treating the unexecuted change as completed.
Feature coverage
- business-acceptance (covered): The team records what protection was enabled and what remains vulnerable. Draft a separately approved PRO change
- recovery (covered): Virtual patching can reduce exposure without repairing plugin code. Record recommendation and repair deadline
Sources
- xCloud agent capability boundaries
- WordPress roles and capabilities
- WordPress plugin administration
- Site backups in xCloud
- WordPress hardening handbook
- Site Security PRO setup and eligibility
- Vulnerability Checker in xCloud
- Manage WordPress updates with Updates Manager
- xCloud MCP documentation and connection profiles