# Evaluate Site Security PRO for a site Evaluate whether Site Security PRO could mitigate a specific plugin finding and record the software repair still needed. Canonical: https://xcloud.host/use-cases/solutions/evaluate-site-security-pro-for-a-site/ Published: 2026-09-30 · Updated: 2026-09-30 · Technical review: 2026-09-30 Evidence: Source reviewed; no production deployment test claimed Editorial owner: xCloud editorial Intent: Confirm plan eligibility, configure the documented protection path, and verify status. For: business-owner, operator ## Requirements and responsibilities - Have named ownership of the domain, selected xCloud team and site, and WordPress administrator access. For this scenario, agree who supplies the data and signs off: An owner asks whether paid Site Security PRO is useful for a vulnerable site. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/) - Use a compatible Nginx or OpenLiteSpeed stack for native WordPress. Verify current server resources, plan eligibility and each selected plugin or service license and requirements before installing; a Docker server does not host a new native WordPress site. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [WordPress plugin administration](https://wordpress.org/documentation/article/manage-plugins/) - Prepare a safe test identity and a completed, accessible backup before consequential changes. The important failure to plan around is: Virtual patching can reduce exposure without repairing plugin code. Sources: [Site backups in xCloud](https://xcloud.host/docs/site-backups-in-xcloud/); [WordPress hardening handbook](https://developer.wordpress.org/advanced-administration/security/hardening/) ## Illustrative situation Illustrative scenario: a WordPress site has a version-based plugin finding. Its owner asks whether paid Site Security PRO is eligible and useful. This evaluation ends with a documented recommendation and unresolved risk; it does not enable protection or repair code. ## Choose the approach - Compare software update, temporary PRO mitigation, disable and removal against the affected component and plan eligibility. Virtual patching is not the same as updating vulnerable plugin code. Sources: [Site Security PRO setup and eligibility](https://xcloud.host/docs/set-up-site-security-pro/); [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) - Keep application setup, domain/DNS ownership, mail delivery and external integrations with their named administrators. Use a plain documented path when a proposed integration cannot be demonstrated end to end. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [WordPress plugin administration](https://wordpress.org/documentation/article/manage-plugins/) ## Dashboard and application procedure ### 1. Identify site entitlement and specific finding **Where:** WordPress public/admin views and relevant provider evidence **Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts. **Inputs:** Identify site entitlement and specific finding; exact site identity, named approver and controlled sample data. **Action:** Identify the exact vulnerable component and Site Security PRO entitlement for the selected site without changing settings. **Expected result:** The evaluation has a specific finding and eligibility. **Verify:** The evaluation has a specific finding and eligibility. Record the observed site, account or transaction and time in the release sheet. **If it fails:** If entitlement is unknown, ask the account owner before planning paid protection. Capability: Review a WordPress business journey Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/); [Site Security PRO setup and eligibility](https://xcloud.host/docs/set-up-site-security-pro/); [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) ### 2. Read pro feature and licensing documentation **Where:** WordPress public/admin views and relevant provider evidence **Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts. **Inputs:** Read pro feature and licensing documentation; exact site identity, named approver and controlled sample data. **Action:** Read current xCloud PRO documentation for virtual patching scope and paid requirements, then read the vendor's fixed-version path. **Expected result:** The owner sees which problems PRO may mitigate. **Verify:** The owner sees which problems PRO may mitigate. Record the observed site, account or transaction and time in the release sheet. **If it fails:** If a feature is not documented for this plan, do not promise it. Capability: Review a WordPress business journey Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/); [Site Security PRO setup and eligibility](https://xcloud.host/docs/set-up-site-security-pro/); [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) ### 3. Compare update, mitigation and removal options **Where:** WordPress public/admin views and relevant provider evidence **Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts. **Inputs:** Compare update, mitigation and removal options; exact site identity, named approver and controlled sample data. **Action:** Compare update, temporary mitigation, disable and remove options against business impact and available test time. **Expected result:** The decision separates code remediation from protection layer. **Verify:** The decision separates code remediation from protection layer. Record the observed site, account or transaction and time in the release sheet. **If it fails:** If software can be safely updated, do not treat mitigation as permanent repair. Capability: Review a WordPress business journey Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/); [Site Security PRO setup and eligibility](https://xcloud.host/docs/set-up-site-security-pro/); [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) ### 4. Draft a separately approved PRO change **Where:** WordPress public/admin views and relevant provider evidence **Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts. **Inputs:** Have administrator configure eligible protection in dashboard; exact site identity, named approver and controlled sample data. **Action:** Draft the proposed dashboard configuration and verification checks for an authorized administrator; do not enable PRO in an evaluation-only task. **Expected result:** A later change can be approved with exact site and cost. **Verify:** A later change can be approved with exact site and cost. Record the observed site, account or transaction and time in the release sheet. **If it fails:** If approval or license is absent, leave the setting unchanged. Capability: Review a WordPress business journey Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/); [Site Security PRO setup and eligibility](https://xcloud.host/docs/set-up-site-security-pro/); [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) ### 5. Record recommendation and repair deadline **Where:** WordPress public/admin views and relevant provider evidence **Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts. **Inputs:** Verify status and retain a software update deadline; exact site identity, named approver and controlled sample data. **Action:** Record recommendation, residual risk and a deadline to update affected code. Keep the finding open until the selected software repair is verified. **Expected result:** Evaluation ends with a concrete owner decision. **Verify:** Evaluation ends with a concrete owner decision. Record the observed site, account or transaction and time in the release sheet. **If it fails:** If no option is acceptable, escalate the open finding rather than declaring the site safe. Capability: Review a WordPress business journey Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/); [Site Security PRO setup and eligibility](https://xcloud.host/docs/set-up-site-security-pro/); [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) ## Maintenance - Assign a cadence for selected WordPress core, theme and plugin updates, review version-based findings and retest the path in this guide. In particular, repeat: The team records what protection was enabled and what remains vulnerable. A chat prompt is not a scheduled task. Sources: [Manage WordPress updates with Updates Manager](https://xcloud.host/docs/manage-wordpress-updates-with-updates-manager/); [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) - Record actual backup completion, storage access and responsible staff. Recheck connected application and provider behavior after changes rather than relying on a site health status alone. Sources: [Site backups in xCloud](https://xcloud.host/docs/site-backups-in-xcloud/); [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md) ## Recovery decisions - This is an evaluation. No Site Security PRO settings or WordPress code are changed; retain the current finding and document the approved future remediation path. A virtual patch is not a software update. Sources: [Site Security PRO setup and eligibility](https://xcloud.host/docs/set-up-site-security-pro/); [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) ## AI handoff Connect xCloud MCP through the current documented profile and grant only the scopes needed for the selected team. Discover tool schemas first. Read resources to plan; require approval for any supported write. Use returned dashboard URLs for manual work. The packaged REST wrapper accepts GET requests only. ### Supported scope - **Confirm requirements and inspect resources** (mcp; read): Discover the connected profile and operation schema first; only teams granted to the connection are visible. Checkpoint: Confirm exact team, server and site identity. Use dashboard\_url returned by the resource; do not invent a dashboard link. Operation identifiers to discover: teams.index, servers.show, sites.show. Scopes: read:servers, read:sites. Sources: [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md) - **Review a WordPress business journey** (app; manual): Application data and observed transactions cannot be inferred from xCloud resource reads. Use authorized test accounts and the application or provider evidence. Checkpoint: Record the test identity, timestamp, expected outcome, observed result and owner decision. Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/) ### Copyable agent brief ```text Review evaluate site security pro for a site for the exact site and team I name. Use permitted reads and ask for application evidence you cannot observe. Work through: Identify the exact vulnerable component and Site Security PRO entitlement for the selected site without changing settings.; Read current xCloud PRO documentation for virtual patching scope and paid requirements, then read the vendor's fixed-version path.; Compare update, temporary mitigation, disable and remove options against business impact and available test time.; Draft the proposed dashboard configuration and verification checks for an authorized administrator; do not enable PRO in an evaluation-only task.; Record recommendation, residual risk and a deadline to update affected code. Keep the finding open until the selected software repair is verified. Return observations, uncertainties, a decision and a separately approvable operator checklist. Do not create, restore, configure, publish or update anything in this review. ``` ### Manual checkpoints - The named site, business or provider owner supplies application evidence the connected hosting reads cannot observe. - A separately approved operator performs any later configuration, staging, update, restore or publication described in the decision sheet. - The owner accepts the review finding and proposed checks without treating the unexecuted change as completed. ## Feature coverage - **business-acceptance** (covered): The team records what protection was enabled and what remains vulnerable. Steps: phase-4 - **recovery** (covered): Virtual patching can reduce exposure without repairing plugin code. Steps: phase-5 ## Sources - [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md) — reviewed 2026-09-30; v4.4.2 package; xCloud v2.8.8 capability review - [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/) — reviewed 2026-09-30 - [WordPress plugin administration](https://wordpress.org/documentation/article/manage-plugins/) — reviewed 2026-09-30 - [Site backups in xCloud](https://xcloud.host/docs/site-backups-in-xcloud/) — reviewed 2026-09-30 - [WordPress hardening handbook](https://developer.wordpress.org/advanced-administration/security/hardening/) — reviewed 2026-09-30 - [Site Security PRO setup and eligibility](https://xcloud.host/docs/set-up-site-security-pro/) — reviewed 2026-09-30 - [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) — reviewed 2026-09-30 - [Manage WordPress updates with Updates Manager](https://xcloud.host/docs/manage-wordpress-updates-with-updates-manager/) — reviewed 2026-09-30 - [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs) — reviewed 2026-09-30 ## Continue [Explore the next WordPress workflow](https://xcloud.host/use-cases/solutions/create-a-wordpress-staging-acceptance-checklist/) - [Manage WordPress plugin updates and security checks](https://xcloud.host/use-cases/operations/wordpress-plugin-updates-and-security/)