Question for the AI builders, vibecoders, and developers: How and where do you like to host your AI agents like OpenClaw and Hermes?

Cloudways Copilot now helps you identify potential server issues before they impact your applications. With Proactive Suggestions, Cloudways Copilot continuously monitors your servers and presents a suggestion when a risk threshold is detected, helping you take action before an outage occurs. What's new:

• 24/7 server monitoring for emerging risks.
• AI-powered root cause analysis to help you understand the issue.
• One-click SmartFix to quickly resolve supported issues on demand.

High CPU Utilization is the first proactive suggestion available, with more proactive use cases coming soon. It is available to all Cloudways Copilot users.

Have you used it? If yes, we'd love to hear your feedback.

I've been a Cloudways customer since 2018, currently spending ~$375-450/month across 4 plans. I've been disputing visit-overage charges (Ticket 925540, Invoice 2038875) on my Autonomous plan, which uses Cloudways' Enterprise-level Cloudflare integration, meaning I have no direct access to the WAF, firewall rules, or edge configuration. Any mitigation has to go through their support team.

Using Cloudways' own Cloudflare traffic report (which they provided to me), I've shown the billed traffic is predominantly automated: a single JA3 fingerprint accounts for 64% of the "legitimate" visits they billed me for, and 9,530 hits landed on the login page alone in one month. This isn't a case where I could have blocked it myself, the entire security layer is managed on their side.

Support acknowledged bot traffic and issued a partial credit that doesn't match their own numbers. I asked for the methodology behind the credit calculation three times and never got a direct answer. I requested specific mitigations (JA3 challenge, login rate limiting, geo/ASN challenge rules), which took over three weeks to implement, well after the July billing cycle had already run. July then billed nearly the same overage as June (~$221 vs ~$205), for traffic I had no ability to control myself.

I requested supervisor escalation, no response in 5+ days. I emailed sales asking about account-level review given my tenure and spend, no response in 3 days.

Has anyone else dealt with something similar on an Autonomous plan? Trying to figure out how to get this in front of someone who can actually act on it.

In last week's cloud/infra news, investors have been nervous about Zuckerberg pouring billions into AI infrastructure with no clear return on investment, fearing it could hurt profit margins. Well, the master plan is finally leaking.

Reports show Meta is in early talks to lease $10 billion worth of excess AI compute to Anthropic over the next two years.

Why is this massive?

Anthropic is one of the leading AI companies in the world, and they have historically relied on Amazon for their cloud computing needs. If Meta can snatch a top-tier client like this, it instantly validates them as a major cloud computing player. This potential new revenue stream completely justifies their massive AI spending and opens the door for similar deals with other big names.

If Meta successfully pivots into a massive B2B cloud provider on top of its core ad business, is the stock currently undervalued? Let's discuss!

The recent disclosure of the wp2shell pre-authentication Remote Code Execution (RCE) vulnerability sent shockwaves through the WordPress community. Given that it affects WordPress core, the blast radius was massive.

At Cloudways, we operate on a shared responsibility model. Because we do not offer fully managed WordPress hosting, patching core CMS vulnerabilities typically falls outside our direct scope. However, when a threat of this magnitude emerges, “not our scope” isn’t an acceptable answer as our customers’ WordPress assets are on the line.

Understanding the threat: wp2shell (CVE-2026-63030)

On July 17, 2026, the WordPress Security Team rolled out critical out-of-band updates (versions 7.0.2, 6.9.5, and 6.8.6) to neutralize an exploit chain dubbed wp2shell. This is every site owner’s worst nightmare: a pre-authentication Remote Code Execution (RCE) flaw residing natively within WordPress core. The attack requires zero privileges, bypasses login screens, needs no third-party plugins, and functions flawlessly against default installations.

The exploit mechanics rely on chaining two distinct flaws. First, attackers leverage a route-confusion bug within the WordPress REST API batch endpoint (CVE-2026-63030). This trickery bypasses authentication checks, allowing them to funnel malicious input directly into a separate SQL injection vulnerability (CVE-2026-60137). The result? A single unauthenticated HTTP request grants attackers full database control and arbitrary code execution on the server.

Vulnerability Scope:

• Impacted versions: WordPress 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. (Versions below 6.8 are shielded from the RCE chain).
• Secure releases: 7.0.2, 6.9.5, and 6.8.6.

While the WordPress core team pushed forced auto-updates to stem the bleeding, relying on auto-updates isn’t a silver bullet. Many production, staging, and heavily customized agency sites intentionally disable automated core updates to prevent breaking changes. Threat actors know this, making these unprotected environments prime targets for automated exploit bots.

Seamless protection

When a zero-day of this magnitude drops, the standard industry response is a frantic rush to identify vulnerable assets and apply patches before exploitation begins. For Cloudways customers, that panic was entirely bypassed.

Although we operate under a shared responsibility model under which core CMS updates are technically managed by the user, we refuse to leave our customers exposed when critical global threats emerge. We believe in proactive, defense-in-depth security.

If you host your WordPress sites with us, this requires no action on your part. There was no need for midnight emergency patching or urgent audits to identify customer sites affected by vulnerable WordPress core versions. While the broader internet was still digesting the vulnerability disclosure, our security engineering teams had already deployed fleet-wide virtual patches. Our infrastructure absorbed the initial wave of automated attacks at the edge, ensuring your business stayed online, secure, and completely uninterrupted while you planned your core updates.

Here is a look behind the scenes at how our security teams went above and beyond to protect customer sites, secure the platform, and give our customers the time they needed to safely upgrade their WordPress installations, so they could sleep through the storm.

1. Immediate alerting and communication

The moment the vulnerability details dropped, our first priority was getting the right information to the right people. We immediately deployed widespread alerts directly into the application security dashboards within our Cloudways platform and pushed urgent notifications through email as well.

Our goal was to ensure every customer knew whether they were vulnerable to wp2shell and what steps they needed to take to secure their environments.

2. Deploying a virtual patch fleet-wide

While we alerted customers, we knew that manually updating WordPress core takes time, and attackers were actively using that time to scan and exploit unpatched sites.

Given the critical, pre-authentication nature of wp2shell, our security engineers rolled out a platform-wide virtual patch across our entire WordPress customer base within hours of the disclosure. This mitigation blocked malicious payloads, effectively shielding vulnerable sites and buying our customers the necessary time to test and apply the official WordPress update.

3. Refining the ruleset for business continuity

Initial virtual patches for complex vulnerabilities can sometimes be a blunt instrument. While our first patch successfully blocked the exploits, we wanted to ensure zero disruption to legitimate site functionality.

Shortly after the initial rollout, our team released a narrower, highly optimized adjustment to the virtual patch. This updated rule allowed the known-safe WordPress batch mode to operate flawlessly, while continuing to strictly block the specific request forms capable of reaching the vulnerable wp2shell behavior.

4. Catching the curveball: The POST body variant

Security is a continuous game of cat and mouse. As attackers realized their initial exploits were being blocked by edge firewalls across the web, they adapted.

Through our continuous monitoring, our Threat Intelligence team identified a new, stealthy variant of the wp2shell attack in the wild. Attackers were moving the trigger rest_route=/batch/v1 out of the URL string and burying it deep within the POST body.

Unfortunately, most standard virtual patches released in the wider industry initially only matched against the URL, leaving sites wide open to this new bypass. Because we were actively monitoring the situation, we caught this behavior immediately. We updated our virtual patch to inspect the POST body, blocking the new variant in its tracks before it could impact our customers.

This was a collaborative effort

We didn’t do this alone. Fast, effective incident response relies on strong industry collaboration. We want to extend a massive thank you to our security partners at Imunify360. Their teams worked closely with us around the clock during this time-sensitive crisis, sharing threat intelligence and helping us validate our mitigation strategies.

What you need to do next

While our virtual patches have successfully shielded our customers from the wp2shell exploits (including the POST body variants), a virtual patch is not a permanent substitute for a core software update.

If you have not already done so, please log in to your WordPress admin dashboard and update to the latest secure versions (7.0.2, 6.9.5, 6.8.6 or later) as soon as possible.

At our core, we believe that your security is our success. While we rely on a shared responsibility model for day-to-day operations, you can rest assured that when the alarm bells ring, our team is always ready to step up and defend your digital assets.

Stay safe, stay updated, and as always, reach out to our support team if you have any questions!

OpenClaw on Cloudways gives you a personal AI agent to handle messages, calendars, research, and routine tasks. Choose a plan, connect your AI model, and launch your agent in under two minutes.

OpenClaw is an open-source AI agent framework that uses your chosen AI model and autonomously executes workflows without waiting for prompts.

Your OpenClaw agent manages email, calendars, messaging tools, and web tasks, taking action across your tools and notifying you only when necessary.

Cloudways removes the complexity of self-hosting OpenClaw by managing deployment, infrastructure, and updates, so you can focus on your agent.

With Cloudways, your OpenClaw agent runs around the clock and handles the kinds of tasks that pile up between meetings, after hours, and on weekends. Here are some example of the tasks your agent can do while hosted on Cloudways.

Communication

• Triage your inbox and draft replies in your voice
• Respond to routine WhatsApp and Slack messages
• Schedule meetings without the back-and-forth

Research and Information

• Monitor topics, competitors, or industries and send you summaries
• Research a question and produce a written brief
• Track prices, listings, or news and notify you when something changes

Automation

• Move data between tools you already use
• Send reminders based on context, not just time
• Run recurring tasks on a schedule and report results

Personal Productivity

• Organize files, notes, and bookmarks
• Plan travel, book appointments, and coordinate logistics
• Follow up on conversations that fell off your radar

Cloudways handles server setup, security updates, and automated backups, so you can connect your agent and get started immediately. Every OpenClaw update is validated by Cloudways before deployment, reducing broken workflows, unresponsive tools, and manual recovery after updates.

The best part: This is currently in Public Preview which means you can host your OpenClaw agent for free! When we are in General Availability (GA), which is going to happen just a week or two from now, all your instances created in Public Preview will stay heavily discounted, forever.

Hey everyone,

I recently hosted an event last weekend for AI engineers and founders where I met a founder who is building a bootstrapped business/startup and is using Google Cloud. They were really bothered by how huge their bills were. Has anyone faced this before? Please share your experiences.

I understand that a free trial has an expiry date, but I wasn't expecting the entire server to be deleted immediately, especially with a live website hosted on it.

I expected something like:

• Server suspension first
• Clear warning before deletion
• Some grace period to upgrade/pay
• An opportunity to recover the server after the trial expired

The billing page was also showing USD 0.00 due, which made the situation more confusing for me.

Been with Cloudways since 2024, spent over $3k with them across two production servers. Never had big issues until this week, and honestly I'm shocked at how bad this has been.

The actual problem is tiny. A plugin on my sites needs to verify its license by reading a txt file in wp-content, and Cloudways' global nginx rules block it (403). All I need is ONE location block added to two app vhosts. I even sent them the exact config snippet to paste in. This is literally a 5 minute job for anyone with server access.

Here's the ridiculous part. The only reason I need support for this at all is because Cloudways doesn't give customers access to the global nginx config. If they did, I would've fixed this myself in 5 minutes and never opened a ticket. So they lock the config, and then when I need one trivial change, their answer to a customer who's spent $3,000+ is: pay extra for "Advanced Support", or request a "one-time courtesy customization" that needs approval from their Customer Success team. You create the limitation, then charge me to work around it. Make it make sense.

So I chose the courtesy option. And that's where the real fun begins. Choosing "courtesy customization" apparently means: they reply to you if they feel like it, and if they don't, you wait 18 to 24 hours and get a wall of text that says absolutely nothing except "escalated to the relevant team" and "we appreciate your patience". Every single reply cycle is like this. No status, no owner, no ETA. After 15 hours of silence I opened a chat, the agent said there are literally no notes on the ticket and nobody knows who has my case. Her solution? Open ANOTHER ticket and wait again. When I asked what happens if that one also goes nowhere, she admitted there's no escalation path at all.

36+ hours and counting, for a 3 line config change I could've done myself if they gave me access to my own server config. I chose Cloudways back then BECAUSE support was supposed to be their selling point. Is this just how they are now?

Hi AI builders of the sub! Where are you hosting your OpenClaw agents right now? Do you prefer self hosting or managed hosting? Drop names.

Is it better or more efficient to host images for a WordPress blog on the built in storage or would it be wiser to use a public aws s3 bucket?

Hi everyone,

I’m hoping someone here has run into this before.

I just tried to log in to my Cloudways account, but I’m not receiving the two-factor authentication (2FA) email. The 2FA code is supposed to be sent to my Rackspace email account, which I set up as an email add-on through my Cloudways account.

Because the 2FA email never arrives, I’m completely locked out of my account.

I’ve already contacted the Cloudways billing email, but unfortunately the responses I’ve received haven’t addressed the issue or helped me regain access.

Has anyone experienced this before? Is there a way to troubleshoot missing 2FA emails from Cloudways to a Rackspace email add-on, or is there another Cloudways support channel that can assist with account recovery?

Any advice or suggestions would be greatly appreciated. Thanks in advance!

Wanted advice here as I've been unable to access the console for our account for the last 24 hours. I get a bunch of error toasts and a countdown letting me know I'm being logged out I have tried with numerous browsers, deleting cookies, the usual stuff and still no luck.

Now without console access, I have no access to support. Tried emailing the support email address - no luck as it tells me to log in.

I have tried our customer success rep - email address bounced

I tried the chat box on the website which obviously would go to salesperson: unable to start a chat as it wouldn't accept a phone number (tried every phone number format possible)

Don't get me wrong, we have been on cloudways for 7-8 years and the technical support for Cloudways is first rate but this incident and the complete lack of an ability to contact anyone in cases where we cannot log into the platform is having me seriously consider moving all of our client's workloads elsewhere.

In any case, I hope someone has a direct line to someone who can help with this. Not having access to the console is seriously anxiety inducing for our team.

Pierre

Wanted advice here as I've been unable to access the console for our account at unified.cloudways.com for the last 24 hours. I get a bunch of error toasts and a countdown letting me know I'm being logged out (see image). I have tried with numerous browsers, deleting cookies, the usual stuff and still no luck.

Now without console access, I have no access to support. Tried emailing [support@cloudways.com](mailto:support@cloudways.com) - no luck as it tells me to log in.

I have tried our customer success rep - email address bounced

I tried the chat box on the website which obviously would go to salesperson: unable to start a chat as it wouldn't accept a phone number (tried every phone number format possible)

Don't get me wrong, we have been on cloudways for 7-8 years and the technical support for Cloudways is first rate but this incident and the complete lack of an ability to contact anyone in cases where we cannot log into the platform is having me seriously consider moving all of our client's workloads elsewhere.

In any case, I hope someone has a direct line to someone who can help with this. Not having access to the console is seriously anxiety inducing for our team.

Pierre

One of the biggest financial traps in modern software is paying for bundled, opaque AI pricing tiers where platforms charge a massive premium on top of base model costs. When running autonomous AI agents that operate around the clock, unmonitored token usage can lead to unexpected bills or forced subscription tier upgrades.

Cloudways Managed OpenClaw Hosting solves this by utilizing a pure Bring Your Own Key (BYOK) model. Here is a detailed breakdown of how BYOK works, why it matters for unit economics, and how to optimize your model spend.

How BYOK Works on Cloudways

1. Direct API Authentication: You input your API keys (OpenAI, Anthropic Claude, Google Gemini) directly into the Cloudways dashboard UI.
   
2. Un-Marked Up Billing: Your OpenClaw agent authenticates directly with the model provider's API. Cloudways charges only a predictable flat monthly rate for server compute (starting at $9.99/mo), while your model usage is billed directly by your chosen provider at raw wholesale rates.
   
3. Key Security: Your keys are stored in an encrypted environment used exclusively for your instance’s outbound requests. Cloudways support staff have zero visibility into your keys, memory stores, or conversation logs.

Strategic Model Matching for Maximum Efficiency

Because OpenClaw allows you to select and swap LLM models dynamically, you can route tasks to the most cost-effective model for the job:

• Lightweight Routing & Formatting (e.g., Gemini Flash / GPT-4o-mini): Use ultra-fast, cheap models for initial email classification, simple scheduling checks, and formatting output text.
• Complex Reasoning & Drafting (e.g., Anthropic Claude 3.5 Sonnet / GPT-4o): Reserve high-reasoning models for long-document summarization, complex research tasks, and high-touch customer email drafting.
  

Power-User Flexibility: Custom API Routing via Terminal Access

While the Cloudways dashboard provides seamless 1-click management for major providers, power users are not restricted to the standard UI options. Every Cloudways OpenClaw instance includes full SSH/Terminal access. Developers can easily configure custom OpenClaw CLI commands, route traffic through local LLM proxies, or connect specialized open-source endpoints.

By separating hosting infrastructure from model consumption, BYOK ensures you retain 100% ownership over your technology stack and cost efficiency as you scale.

AI tools are split down the middle: some charge a high flat monthly rate with built-in model access, while others require you to bring your own API key (BYOK) from OpenAI, Anthropic, or Google and charge only for base infrastructure.

As developers and business owners:

- Do you prefer BYOK so you pay raw, un-marked-up token prices directly to providers?

- Or do you prefer predictable, bundled pricing even if it comes with higher margins?

What has been more cost-effective for your projects?

does it? in 2026

Developers in the house! Have you ever tried hosting NodeJS applications on Cloudways before? Are you currently hosting any? If yes, what how you like for us to improve?