What's New with Astra

Hey everyone 👋

This one is pure repair work. Two security holes are closed, scheduled Customizer changes actually go live again, and a run of layout and styling bugs are gone. Nothing new to learn here. Just things behaving the way they always should have.

Let’s get into it.

🔐 Security

• Stored cross-site scripting in the Header Builder account element. The link’s rel value was written into the page as an unquoted HTML attribute, which left room for injected markup to break out and run. Closed.
• Live search could surface post types you never enabled. The search request pulled from post types beyond the ones switched on in the Customizer, so content you had deliberately kept out of search could still come back in results. It now queries only what you’ve enabled.

🐛 Squashed

• Scheduled Customizer changes now actually publish. Scheduling a design change used to fail with a fatal error when WordPress went to apply it in the background. Worse, on setups where it didn’t error outright, the scheduled Astra settings were quietly dropped, and the site just carried on with the old design. Both halves are fixed. Your scheduled change publishes, and it takes effect.
• Dropdown arrows sit back on the same line in Firefox. On some older sites, the top-level arrow dropped onto its own row underneath the menu item. That was a regression from the bigger tap targets added in 4.13.11. Fixed.
• Buttons with no link no longer pretend to be clickable. A Header or Footer Builder button with an empty URL still rendered as a link, hand cursor and all, so visitors clicked something that did nothing. It’s now plain text until you give it a URL.
• Breadcrumb line height works with every breadcrumb source. The setting was being ignored in favour of a fixed default, including when Yoast or Rank Math supplied the breadcrumbs. Your value now applies on the front end.
• The typography dropdown stops collapsing on imported templates. If a template you imported left the line height unit blank, the panel folded up and took Line Height and Letter Spacing with it. Both are reachable again.
• RTL styling is back on Dokan, WooCommerce Cart and Checkout blocks, and LifterLMS. Three right-to-left compatibility stylesheets were returning a 404, so those pages silently lost Astra’s layout fixes. The missing files now ship.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one is small but worth taking. We closed a security hole in Page Headers where the layout setting could be pointed at files it had no business loading. Alongside it: two blank screens are gone, version rollback behaves itself again, and the Blog spacing controls finally explain what they affect.

Let’s get into it.

🔧 Better than before

• Blog spacing controls now tell you what they actually affect. The “Inside” and “Outside” spacing options under Blog Post spell out which container layouts and styles they apply to, so you’re not left guessing why a value did nothing.

🐛 Squashed

• Page Headers can no longer be pointed at arbitrary files on your server. The layout setting accepted any value, so a crafted one could pull in PHP files that were never meant to be templates. It’s now restricted to Astra Pro’s own templates. This is a security fix.
• Rolling back twice in a row now works. Choosing an older version a second time quietly reinstalled the latest one instead of the version you picked. Squashed.
• The Customizer no longer goes blank on locked-down servers. On hosts without direct file write access, opening or saving the Customizer could run out of memory and leave you staring at a white page. Fixed.
• Site Builder Display Conditions opens on layouts with no rules set. An empty display rule set sent you to a blank screen, and it broke the layout settings panel in the editor too. Both gone.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

This release is mostly housekeeping, and the important kind. Two security issues reported through Patchstack are now fixed, both involving markup being saved by people who shouldn’t be able to save it. Editing long pages also got noticeably quicker, and you can finally decide how your trimmed excerpts end.

Let’s get into it.

✨ What’s new

• Decide how your trimmed excerpts end. Blog and archive excerpts now have a Truncation Marker field under Post Elements > Excerpt.
• A filter for Live Search results. Developers can now shape the query behind Live Search with the new astra_live_search_query_args filter. Handy for limiting results to certain post types, excluding categories, or changing how many results come back.

🔧 Better than before

• Editing long pages feels much faster. Astra used to re-sync its layout and background on every keystroke. Now it syncs only when those settings actually change.
• Dropdown arrows are easier to tap. Top-level navigation arrows now meet the WCAG 2.5.8 target size guideline, so they’re far less fiddly on a phone.

🐛 Squashed

• The Header/Footer HTML widget accepted iframes from users who shouldn’t be able to add them. Anyone without the unfiltered_html capability could inject markup that then rendered site-wide. Fixed. (Props: savphill / Patchstack)
• Post meta Divider Type accepted arbitrary markup and printed it unescaped. Same class of problem, different field. Fixed. (Props: Patchstack)
• Starter content is applied more carefully on a fresh install. It now loads only the settings it ships with, and leaves unrelated site options alone.
• The […] excerpt marker showed on the first post only. It now behaves the same on every post in the loop, which by default means it’s hidden.
• WooCommerce product search showed the wrong sidebar. Search results were falling back to your blog sidebar and its widgets instead of the Product Catalog sidebar. A regression from 4.13.9. Fixed.
• Local webfonts returned 404s on Bedrock and other subfolder installs. The font URL was being built from site_url() when it needed home_url(). Fonts load again.
• Child theme palette names no longer get overwritten. Custom color names set in a child theme’s theme.json were being replaced by Astra’s default labels in both the block editor and the Customizer.
• A console error when saving a post twice. With the Custom Fields panel enabled, the second save threw “Cannot read properties of null”. Gone.
• Tapping a submenu arrow followed the parent link. On touch devices, the arrow opened the parent menu item’s link instead of the submenu. It opens the submenu now.
• Update Global Palette through the Abilities API failed. Passing colors caused a fatal error, and colors came back as arrays instead of objects. Both fixed.
• The Starter Templates banner spinner sat crooked. Misaligned next to its label. Straightened.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

Site Builder had a habit of going quiet when something went wrong. A failed request bounced you back to the Astra dashboard with no explanation. A snippet could stop running and never tell you. This release fixes the disappearing acts and clears up an empty My Account menu for WooCommerce Memberships stores.

Let’s get into it.

🔧 Better than before

• You stay on the page when a layout fails to load. Site Builder now shows an inline error with a Retry button instead of quietly sending you back to the Astra dashboard.
• Custom Layouts built with Elementor’s V4 editor look right on the frontend. Atomic element styles now load properly, so what you design is what visitors see.
• The code editor tells you whether your snippet is actually running. A banner at the top of the editor says running or not running. If PHP execution is disabled on your site, you’ll know that’s why nothing happens. If a snippet belongs to someone who is no longer an administrator, or to an account that no longer exists, it says so and points you to the code to review.

🐛 Squashed

• Code editor snippets keep running when the author’s account changes. Demote the person who wrote a snippet to a lower role, or delete their account, and the code used to stop running. It keeps working now, and the editor flags it so you can review it.
• Archive templates using “All Categories Archive” no longer kick you back to the dashboard. A single PHP warning in the layouts response was enough to derail the whole screen. Squashed.
• The layouts screen no longer throws a PHP warning when a layout’s author has been deleted. Gone.
• My Account navigation shows up again on WooCommerce Memberships pages. With Modern My Account View enabled, the members area rendered an empty navigation, leaving customers no way to move between sections. Fixed.
• The “Enable Code Editor” button sits where it should. Its icon was nudged out of line in the layout editor.

Update when you get a chance.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

This one is small and practical. Astra is now tested against WordPress 7.1, so you can update core without wondering whether your theme will keep up. We also cleaned up two rough edges: a misaligned row on the classic WooCommerce Cart page, and an off-looking focus outline in the Customizer color picker.

Let’s get into it.

🔧 Better than before

• Astra is ready for WordPress 7.1. Tested and verified against the latest WordPress release, so updating core is one less thing to worry about.

🐛 Squashed

• The classic Cart page lines up properly again. On WooCommerce’s classic Cart, the coupon code field, the Apply coupon button, and the Update cart button were each rendering at a different height, leaving the whole row looking uneven. Fixed.
• Color palette swatches look right when you select them. Clicking or tabbing to a swatch in the Customizer color picker drew a focus outline at the wrong size. Squashed.

Update when you get a chance.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

This release is all about smoothing out rough edges. Sticky headers behave themselves again, Post Filters stopped showing blank pages, and a stubborn “update available” notice is finally gone. There’s also a security hardening fix for Site Builder that makes this one worth installing sooner rather than later.

Let’s get into it.

🔧 Better than before

• Site Builder output is more tightly escaped. The author name shown in Advanced Headers archive titles is now hardened against unexpected markup.

🐛 Squashed

• Site Builder layouts with custom code are locked down properly. Code-editor layouts are now restricted to admins, and snippets that aren’t meant to run are sanitized before display. This prevents stored scripts from reaching your site’s front end. Patched.
• WPML users: your Customizer text stays in the right language. Header and footer HTML, button text, and similar strings could get permanently saved in the wrong language during plugin updates. Fixed.
• That lingering “update available” notice is gone. After updating from an older version, Astra Pro could still offer you the version you’d just installed. Cleared.
• SVG logos survive the shrink effect. Enabling “Enable Shrink Effect” on the Sticky Header made SVG logos vanish. They stay put now.
• Sticky headers stopped drifting left. With the Max Width site layout, the Primary Header shifted left on scroll when a margin was set, and the Above/Below Header did the same with Scroll or Fade animations. Both stay centered now.
• Creating an Overlay Template no longer crashes the Block Editor. Starting a new Overlay Template from a Navigation block’s settings threw an “astra-custom-layout plugin has encountered an error” message. Squashed.
• One popup is enough. On mobile product category pages, the WooCommerce Product Filters block opened a second popup inside the Off-Canvas filter flyout. It doesn’t anymore.
• Live Search plays by HTML rules. The Header Cover search style rendered the same id twice on the page when used with the Header/Footer Builder. Fixed, and your markup validates again.
• The Pagination spacing control stopped hiding. Turning off the Blog Pro module made the Blog / Archive “Pagination” spacing setting disappear from the Customizer. It’s back where it belongs.
• Post Filters show your custom templates now. Clicking a category tab that used a custom Site Builder template showed a blank content area. Those tabs now load the page directly so your template renders in full.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

This one is all about polish. Your mobile logo now loads a lighter, right-sized image, and we cleaned up a batch of quirks across WPML sites, WooCommerce shops, search, and the header builder.

Let’s get into it.

🔧 Better than before

• Mobile pages load faster. If you use a different logo for mobile, Astra now serves a right-sized image variant instead of the full-size original. Smaller download, better LCP score, quicker first paint on phones.

🐛 Squashed

• Customizer text no longer gets saved in the wrong language on WPML sites. Strings like header and footer HTML or button text were being permanently overwritten with a translation whenever the theme updated or settings were saved. Your original text stays put now.
• The search form outputs valid HTML again when Live Search is on. The autocomplete attribute was being escaped as a whole string instead of just its value, producing invalid markup. Fixed.
• Product search results keep their own layout. Shop page settings for sidebar, container, title, header, and footer were leaking onto the WooCommerce product search results page. They no longer override it.
• Rotating a tablet no longer breaks the desktop header. On slow-loading pages, mobile menu styles could briefly stick to the desktop header after resizing or rotating across the header breakpoint. Gone.
• The Read More button shows up on search results again. It went missing on posts listed after a Beaver Builder page containing a Posts module. Back where it belongs.
• The Account element in the Header Builder shows your assigned menu. If the WooCommerce account menu was enabled and WooCommerce was later deactivated, the element rendered an empty menu instead of falling back to your Account Menu. Squashed.
• Dismissed admin notices stay dismissed. Some notices could occasionally reappear after you closed them. Not anymore.

Update when you get a chance.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

This one is all about the small things that make a site feel off: a checkout summary that wouldn’t show up, a wp-admin link leaking to search engines, and a mega menu failing HTML validation. All handled.

Let’s get into it.

🔧 Better than before

• Subscription prices no longer crowd the quantity in Modern Checkout. If you sell with WooCommerce Subscriptions, the order review table now puts proper spacing between the product quantity and the recurring price, so they read as two things instead of one jumble.

🐛 Squashed

• The mobile order summary in Modern Checkout no longer shows up empty. When certain plugins like WooCommerce Amazon Pay added their own markup to the checkout page, the collapsible summary stayed blank and shoppers couldn’t see what they were buying. Fixed.
• Your wp-admin edit links are no longer visible to search engines. Blog Pro and WooCommerce pages were including the post edit URL in public page code, even for logged-out visitors. Search engines were finding those wp-admin links and flagging them as inaccessible in Search Console. Gone.
• Full-width mega menus now output valid HTML. The Full and Full Stretched layouts were leaving a wrapper element unclosed, which failed W3C validation on any page using them. Closed and clean.
• The Post Filter plays nicely with “All” again. With Blog Pro’s Layout 1 and the Post Title Area enabled, clicking “All” left the banner and title area stuck on the last filter instead of resetting. It resets properly now.
• Turning off Site Builder no longer leads to a dead end. Its tab in the Astra dashboard used to throw an access denied error when the module was disabled. Now the tab is simply grayed out with a tooltip explaining why.

Update when you get a chance.

As always, support is one click away if anything feels off.

— Team Astra Pro

Hey everyone 👋

If you updated to 4.13.7 and your Elementor theme colors suddenly snapped back to the Customizer defaults, this one is for you. We tracked it down to a change we made in that release. It is fixed.

Let’s get into it.

🐛 Squashed

• Theme palette colors you picked in the Elementor editor no longer revert to the Customizer default. After updating to 4.13.7, choosing an Astra palette color on a widget would look right until you saved or reloaded, then it would flip back. Astra was not handing its palette colors to Elementor properly. Squashed.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

— Team Astra