v3.26.0 is one of our biggest infrastructure releases this year. You can now clone a site into a different datacenter, connect AI tools to your entire InstaWP account through a new account-level MCP server, and run a more complete white-label business with WaaS v3.
Suffix domains are also no longer tied to a single server group, so any suffix works with any region. On top of that, this release adds a dedicated site settings page, a site activity log, same-site restore, and a long list of billing, migration, and domain reliability fixes.
Here is everything in this release, in order of impact.
Table of Contents
Key Takeaways
v3.26.0 expands where your sites can run and how you connect to them: cross-datacenter cloning, an account-level MCP server for AI tools, WaaS v3 for resellers, and a deep round of billing, migration, and domain fixes.
Cross-datacenter clone: Clone any site into a different region, with suffix domains that now work with any datacenter.
Account MCP server: Connect AI tools to your whole account with OAuth 2.1, a full tool catalog, and per-tool gating.
WaaS v3: OTP-verified site deletion, WordPress role config at creation, and a smoother demo-to-paid flow.
Dedicated site settings page: Manage plan, expiry, and reservation in one place with reorganized navigation.
Reliability fixes: Cross-DC clone 403s, custom domain loss after migration, and Stripe webhooks on protected WooCommerce sites, all resolved.
What’s New
#1: Account-Level MCP Server
A new account-level MCP server lets AI tools work across your entire InstaWP account, not just a single site.
This extends InstaWP’s MCP support from a single site up to your whole account. It uses OAuth 2.1 for secure authorization, ships with the full tool catalog plus per-tool gating so you decide exactly which actions an AI client can take, and adds a dedicated Settings page to manage it.
Magic Login auto-assign means access is wired up for you, so connecting Claude or another AI client to manage sites across your account is a short setup.
#2: Cross-Datacenter Site Clone
You can now clone any site into a different datacenter region, and suffix domains are no longer locked to a single server group.
This opens up real geographic flexibility. You can place a copy of a site closer to its audience, stand up a disaster-recovery copy in another region, or move a site between datacenters without changing its domain. Because suffix domains are now decoupled from server groups, any suffix works with any datacenter, so you are free to run a site wherever makes the most sense.
#3: WaaS v3
WaaS v3 makes the white-label hosting business you run on InstaWP safer and more complete.
Site deletion is now OTP-verified, so a site cannot be removed by accident by a client or teammate without confirming a one-time code. You can configure WordPress user roles at the moment a site is created, a proper “No payout found” empty state replaces a blank screen for resellers with no payouts yet, and a clear demo-site ready message tells trial users the exact moment their site is live.
#4: Dedicated Site Settings Page
Each site now has a dedicated settings page for plan, expiry, and reservation, with reorganized site navigation.
These controls used to be spread across the interface. They now live together on one page, so changing a plan, adjusting expiry, or reserving a site is a single, predictable place to go, and the surrounding navigation was reorganized so the settings you reach for most are easier to find.
#5: Same-Site Restore
You can now restore a site directly from its own backup.
When a change goes wrong, you can roll the same site back to one of its earlier backups without cloning it or moving anything elsewhere. It is the fastest way to undo a bad update or a broken edit and get a site back to a known-good state.
#6: Site Activity Log and SSH File Access
This release adds a per-site activity log and secure SSH file read and write.
The activity log gives agencies an audit trail of what changed on a site and when, which is useful for both debugging and client reporting. SSH file read and write lets developers read and edit a site’s files over SSH, with secure path validation that keeps access inside that site’s own files.
Improved
Suffix Domains on Every Server Group
Suffix domains are now available across all server groups, not just the group a domain was created in. This is what makes cross-datacenter cloning work cleanly: your chosen suffix stays valid no matter which region a site ends up running in.
Free Tier Retired
The free tier has been retired. New free sites can no longer be created, and free-tier claims have been removed from onboarding and transactional emails so the signup experience matches what is actually offered.
Clearer, More Capable Migrations
Live import now forwards the destination’s disk quota, so a migration understands its space limits up front instead of discovering them mid-transfer. You can also switch between the V3 and V4 migration engines directly in the UI, giving you control over which engine handles a given move.
Fleet-Wide Memory Hardening
We disabled Transparent Huge Pages and enabled proactive memory compaction across the fleet. In practice this is insurance against memory-compaction storms, so sites stay stable under load without anyone needing to tune the underlying servers.
Cleaner Pay-Per-Use Settings
Pay-per-use settings are tidier. The PHP worker (pm.max_children) field is now hidden because it is managed for you, the background job runner was updated to a newer version, and a deprecated metering job was removed so billing runs on a leaner pipeline.
Fixed
Cross-Datacenter Clone 403 Errors
Cross-datacenter clones that used a legacy backup (a manual, on-demand, or clone-generated backup) could fail with a 403 error during restore, because the download link was signed against the wrong storage location.
The clone now resolves the correct location from the backup path, so these clones complete. Automated and snapshot backups were never affected, and no data was lost, so any previously failed cross-DC clone can simply be retried.
Stripe Webhooks on Protected WooCommerce Sites
WooCommerce sites behind Bunny Shield could see Stripe payment webhooks fail. The wc-api endpoint now bypasses the WAF automatically, so Stripe webhooks go through on CDN-protected stores with no manual firewall changes. If you saw failed webhooks on an affected site, you can retry them.
Server-to-Server Migration Reliability
Server moves are far more dependable. Mapped custom domains are now re-created on the destination server after a move, so sites no longer lose their domains in transit.
The domain re-apply step runs in its own job to avoid queue timeouts on sites with many domains, domain mapping is dispatched asynchronously, and A-record cleanup is more precise. Sites migrated before this release may still need a one-time manual re-apply of their custom domains.
Accurate Billing Emails and Card Safeguards
Several billing issues are resolved. Dunning emails now show the real past-due amount instead of the confusing “$0.00 payment didn’t go through” message, the pay-per-use invoice estimate no longer counts resources you have already deleted, invoices under $1 are suppressed, and you can no longer remove your default card while the account has a past-due balance.
Cleaner Suffix Domain and Site Creation Handling
Requests that reference a soft-deleted or missing server group now return a clean 404 instead of a 500 error, and new sites can no longer be assigned a soft-deleted suffix domain. In the rare case where a group’s suffix domains have all been archived, site creation now clearly reports that no domain is available rather than failing in a confusing way.
Account and Integration Guards
A few smaller correctness fixes round out the release: ActiveCampaign tag validation was tightened so bad tags no longer slip through, and email verification is now reset when an account is deleted, keeping account state consistent.
Security
This release includes two security-focused changes.
- No leaked backup links: Time-limited presigned backup URLs are no longer written into job failure records, so download links cannot leak through error logs or alerting.
- Hardened social sign-in: The Twitter/X OAuth callback now rejects any request that arrives without a valid verifier, closing an edge case in the sign-in flow.
Final Thoughts
v3.26.0 widens where InstaWP can run and how you work with it. Cross-datacenter cloning gives you genuine geographic flexibility and a disaster-recovery path, the account-level MCP server brings AI to your entire account, and WaaS v3 makes the business you sell on InstaWP safer to operate.
For developers, agencies, and resellers, that adds up to sites you can place in any region, AI tools wired into your account, and a long list of billing, migration, and domain issues quietly put to rest.
? Try the latest InstaWP updates now and build, host, manage, and sell WordPress sites across more regions, with more control.
