Requirements and responsibilities
Have named ownership of the domain, selected xCloud team and site, and WordPress administrator access. For this scenario, agree who supplies the data and signs off: A WooCommerce site has product pages and personalized cart and account paths.
xCloud agent capability boundaries · WordPress roles and capabilities
Use a compatible Nginx or OpenLiteSpeed stack for native WordPress. Verify current server resources, plan eligibility and each selected plugin or service license and requirements before installing; a Docker server does not host a new native WordPress site.
xCloud agent capability boundaries · WordPress plugin administration
Prepare a safe test identity and a completed, accessible backup before consequential changes. The important failure to plan around is: Page cache leakage can expose or stale personalized content.
Illustrative situation
Illustrative scenario, not a customer case study: A WooCommerce site has product pages and personalized cart and account paths. Separate sessions show correct carts, prices and account details.
Choose the approach
Map cacheability per URL and user state before changing settings. Verify the selected provider or plugin documentation and license against this requirement; xCloud hosting does not supply its business configuration.
xCloud agent capability boundaries · xCloud MCP documentation and connection profiles · WordPress roles and capabilities
Keep application setup, domain/DNS ownership, mail delivery and external integrations with their named administrators. Use a plain documented path when a proposed integration cannot be demonstrated end to end.
xCloud agent capability boundaries · WordPress plugin administration
Dashboard and application procedure
Follow these steps yourself, or use the scoped AI handoff below for supported hosting operations.
Step 1 of 5
List product, cart, checkout and account url patterns
- Where
- WordPress public/admin views and relevant provider evidence
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- List product, cart, checkout and account url patterns; exact site identity, named approver and controlled sample data.
- Action
- List product, cart, checkout, account and booking paths and whether each response is public or personalized.
- Expected result
- The cache review has a URL-state matrix.
- Verify
- The cache review has a URL-state matrix. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- If a route's data ownership is unknown, treat it as dynamic until tested.
Sources: WordPress roles and capabilities · xCloud WordPress caching overview · WooCommerce testing orders
Step 2 of 5
Inspect current xcloud and plugin cache rules
- Where
- xCloud team/site resource read and planning sheet
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- Inspect current xcloud and plugin cache rules; exact site identity, named approver and controlled sample data.
- Action
- Inspect xCloud and plugin cache settings using permitted reads or dashboard view; identify the layer responsible for page exclusions.
- Expected result
- The reviewer knows which control governs each path.
- Verify
- The reviewer knows which control governs each path. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- If OpenLiteSpeed exclusions live in a plugin, do not claim xCloud MCP can change them.
Sources: xCloud agent capability boundaries · xCloud MCP documentation and connection profiles · xCloud WordPress caching overview · WooCommerce testing orders
Step 3 of 5
Specify bypass or exclusion rules in responsible interface
- Where
- WordPress public/admin views and relevant provider evidence
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- Specify bypass or exclusion rules in responsible interface; exact site identity, named approver and controlled sample data.
- Action
- Propose bypass rules for cookies, logged-in accounts and dynamic paths using the selected cache tool's own docs, without applying them in this review.
- Expected result
- An administrator has a testable configuration proposal.
- Verify
- An administrator has a testable configuration proposal. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- If a rule could bypass too much public cache, narrow it before approval.
Sources: WordPress roles and capabilities · xCloud WordPress caching overview · WooCommerce testing orders
Step 4 of 5
Test anonymous and two logged-in sessions
- Where
- WordPress public/admin views and relevant provider evidence
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- Test anonymous and two logged-in sessions; exact site identity, named approver and controlled sample data.
- Action
- In two separate sessions inspect cart contents, account details and price while reviewing current behavior.
- Expected result
- No observed cross-session state is exposed.
- Verify
- No observed cross-session state is exposed. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- If data leaks now, escalate immediately and disable risky cache through an authorized operator.
Sources: WordPress roles and capabilities · xCloud WordPress caching overview · WooCommerce testing orders
Step 5 of 5
Record owner, purge procedure and regression cases
- Where
- WordPress public/admin views and relevant provider evidence
- Permissions
- Named WordPress/app administrator or business owner; use authorized test accounts.
- Inputs
- Record owner, purge procedure and regression cases; exact site identity, named approver and controlled sample data.
- Action
- Record proposed rules, purge procedure and a regression list for a separate approved change.
- Expected result
- The implementation owner can verify the later edit.
- Verify
- The implementation owner can verify the later edit. Record the observed site, account or transaction and time in the release sheet.
- If it fails
- Do not infer safety from a single anonymous speed test.
Sources: WordPress roles and capabilities · xCloud WordPress caching overview · WooCommerce testing orders
Maintenance
Assign a cadence for selected WordPress core, theme and plugin updates, review version-based findings and retest the path in this guide. In particular, repeat: Separate sessions show correct carts, prices and account details. A chat prompt is not a scheduled task.
Manage WordPress updates with Updates Manager · Vulnerability Checker in xCloud
Record actual backup completion, storage access and responsible staff. Recheck connected application and provider behavior after changes rather than relying on a site health status alone.
Recovery decisions
This review does not change production settings. Keep the original measurements and configuration, then write a separately approved experiment and rollback criterion before any cache, PHP or capacity change.
xCloud WordPress caching overview · xCloud agent capability boundaries
AI handoff
Connect xCloud MCP through the current documented profile and grant only the scopes needed for the selected team. Discover tool schemas first. Read resources to plan; require approval for any supported write. Use returned dashboard URLs for manual work. The packaged REST wrapper accepts GET requests only.
Supported scope
- Confirm requirements and inspect resources mcp · read
Discover the connected profile and operation schema first; only teams granted to the connection are visible.
Checkpoint: Confirm exact team, server and site identity. Use dashboard_url returned by the resource; do not invent a dashboard link.
Operation identifiers and scopes to discover
teams.index, servers.show, sites.show
Scopes: read:servers, read:sites
xCloud MCP documentation and connection profiles · xCloud agent capability boundaries
- Review a WordPress business journey app · manual
Application data and observed transactions cannot be inferred from xCloud resource reads. Use authorized test accounts and the application or provider evidence.
Checkpoint: Record the test identity, timestamp, expected outcome, observed result and owner decision.
Copyable agent brief
Manual checkpoints
- The named site, business or provider owner supplies application evidence the connected hosting reads cannot observe.
- A separately approved operator performs any later configuration, staging, update, restore or publication described in the decision sheet.
- The owner accepts the review finding and proposed checks without treating the unexecuted change as completed.
Feature coverage
- business-acceptance (covered): Separate sessions show correct carts, prices and account details. Test anonymous and two logged-in sessions
- recovery (covered): Page cache leakage can expose or stale personalized content. Record owner, purge procedure and regression cases
Sources
- xCloud agent capability boundaries
- WordPress roles and capabilities
- WordPress plugin administration
- Site backups in xCloud
- WordPress hardening handbook
- xCloud MCP documentation and connection profiles
- Manage WordPress updates with Updates Manager
- Vulnerability Checker in xCloud
- xCloud WordPress caching overview
- WooCommerce testing orders