What's New with Astra

Hey everyone 👋

This release leans into security. We tightened up Modern Checkout, Site Builder, and Page Headers, and refreshed the bundled sanitizer library. On top of that, custom layouts got a lot more flexible, the Mega Menu is friendlier for screen readers, and a handful of WooCommerce and Customizer annoyances are gone.

Let’s get into it.

✨ What’s new

• One layout, placed on many hooks. Custom layouts built with the Hooks layout can now sit on several predefined and custom hooks at once.
• What that means for you:
  • No more duplicating the same layout just to show it in two places.
  • Build your content once, then point it wherever it needs to appear.
  • Fewer layouts to manage as your site grows.
• Learn how it works (https://wpastra.com/docs/custom-layout-hooks/)

🔧 Better than before

• Sticky Logo Width now works with the Shrink effect. You can set exactly how small your logo gets when the header shrinks on scroll.
• The Mega Menu is easier to navigate. Submenu toggle arrows now announce their menu item to screen readers, and Disable Link mega menus open on click.
• Modern Checkout fields look cleaner. Fields are a touch taller, and the Country and State dropdowns line up and show their labels like every other field.
• Rollback is clearer when there’s nothing to roll back to. The dropdown stays visible but inactive, with a tooltip explaining why.
• Better YITH Pre-Order compatibility. Out-of-stock products offered as pre-orders now add to the cart with Slide In Cart, Redirect to Cart/Checkout, and Quick View.

🐛 Squashed

• Slide In Cart no longer freezes the page. Adding a product with the Single Product Slide In Cart action used to lock scrolling when the header Cart Click Action was set to Cart Page. Fixed.
• Grouped products with large IDs add to cart again. They were silently failing with AJAX actions like Slide In Cart. Gone.
• The sticky logo resizes smoothly. With the Shrink effect on, the logo now scales in step with the rest of the header instead of snapping.
• Live preview keeps up with font changes. Blog and archive post titles now update in the Customizer preview the moment you switch the Body or Headings font.
• Complex image URLs load fully. Page Header background images with more than one query parameter, like CDN or signed URLs, now keep all their parameters.

🔒 Security

• Comments and previous posts are locked down. Comments shown through Custom Layouts no longer run shortcodes, and Auto Load Previous Post only pulls pages from your own site. (Props to savphill / Patchstack.)
• Modern Checkout logins stay secure on HTTPS. Session cookies set when logging in from the Modern Checkout page are now marked secure.
• The checkout email check gives nothing away. It no longer hints at whether an account exists when Modern Checkout isn’t in use, or when checkout login and account creation are turned off.
• Custom layout shortcodes respect permissions. The shortcode only renders layouts a visitor is allowed to see, and code editor snippets can no longer be changed through custom fields.
• Page Headers are admin-only now. Only administrators can manage them, and their color, size, and image settings are validated before use. Your existing Page Headers keep working.
• Updated the bundled sanitizer library. DOMPurify moved to 3.4.17, picking up upstream fixes for several HTML sanitization bypasses (CVE-2026-0540).

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one’s all about polish. We tracked down a mix of annoyances across WooCommerce, menus, the Customizer, and accessibility, including one that could cut a page off mid-load. Nothing you have to relearn. Just things working the way they should.

Let’s get into it.

🐛 Squashed

• Slide In Cart now opens when your header cart points to the Cart page. Adding a product from the shop, an archive, or any product list wasn’t triggering the Slide In Cart if the header Cart Click Action was set to “Cart Page.” It opens every time now.
• A bad menu add-on can no longer take your whole page down. If a plugin or custom walker passed the wrong kind of value to the menu link filter, it threw a fatal error that cut the page off halfway through loading. That path is guarded now, so the page keeps rendering.
• Submenu toggles finally make sense to screen readers. Expandable menu items now announce which item they control and whether they’re open or closed. As a bonus, anything added after a menu link (like Mega Menu content) is left untouched instead of getting rewritten.
• Archive banner text is translatable again in WPML. Custom titles and descriptions for your Blog and post-type archives, WooCommerce catalog, EDD, and SureCart pages now show up in WPML String Translation.
• Live Search results look right on phones and tablets. On right-to-left sites, the results dropdown was rendering as a squeezed, broken list on archive pages with pagination. Fixed.
• The Posts page editor only shows settings that actually apply. Container, Sidebar, and Advanced Settings no longer appear when you’re editing your blog’s Posts page, since they don’t affect the listing anyway.
• Setting Body font back to Default shows the real default font. The live preview was falling back to a serif font instead of your system default. Now the preview matches what visitors see.
• Closing the Slide In Cart with Esc behaves properly. Pressing Esc used to throw a console error. Now it closes the cart cleanly and sends focus back to the cart icon, exactly where keyboard users expect it.

We think you’ll like this one. Update when you’re ready.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

Astra’s Global Palette has always given you nine colors to work with. Now you can add your own on top of those, give them real names, and use them everywhere you already pick colors. We also closed three security issues and smoothed out a few things for WooCommerce and Easy Digital Downloads stores.

Let’s get into it.

✨ What’s new

• Your own named colors in the Global Palette
  • There’s a new + button under Global > Colors. Click it and add a color that’s yours, on top of the nine Astra ships.

• What that means for you:
  • Name your colors something you’ll actually recognise, like “Brand Teal” or “Footer Grey”, instead of hunting for a hex code every time
  • They show up in the block editor, in Elementor, and in every Astra color picker, so there’s one list of colors everywhere
  • Change a color once and everything using it updates across the site
  • Add up to nine of your own. Remove one and its value is kept, so adding it back later restores exactly what you had

→ Learn how it works

🔧 Better than before

• WooCommerce shops do less work on every page load. Astra was sending the same cart refresh request twice, once on page load and again after add to cart. The duplicates are gone, so there’s less load on your server, especially on busy stores.

🐛 Squashed

• Live Search no longer trusts what’s in a post title. A carefully crafted title could run script in a visitor’s browser when it appeared in search results. Squashed.
• Background settings can’t leak into your stylesheet. Page and content background values saved by someone with limited editing access could inject their own rules into the front-end CSS. They’re sanitized properly now.
• Author avatars handle odd post titles safely. On blog and archive pages, markup inside a post title could break out of the avatar’s alt text. Gone.
• No more blank gap on Easy Digital Downloads pages. On a fresh install, single download pages rendered an empty sidebar-width space until you opened the download and saved its Sidebar Layout once. Fixed.
• Anchor links stay shareable when Smooth Scroll is on. With “Smooth Scroll to ID” enabled, clicking a section link scrolled you to the right place but left the URL alone, so the link you copied went nowhere. The #hash now updates after the scroll, and reloading lands you back in the same spot.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one is almost entirely for store owners. Your cart drawer opens the moment you add a product, your checkout stops forgetting things customers already typed, and product galleries no longer show a thumbnail that was never meant to be there. Two fixes outside WooCommerce round it out.

Let’s get into it.

🔧 Better than before

• The Slide In Cart opens the instant you add a product. Astra was sending the same cart refresh request twice on every add-to-cart. One of them is gone, so the drawer slides open right away instead of waiting on a duplicate round trip.

🐛 Squashed

• Product galleries no longer show a stray thumbnail. When a product used the same image for its main photo and its gallery, the Vertical Slider and Horizontal Slider layouts rendered a misplaced thumbnail strip beside it. Those products now show a single image, matching how WooCommerce 11.1 handles it.
• Saved checkout details come back the way customers left them. A third-party checkout field with no name could quietly stop the whole restore, and the State field was dropped whenever a customer switched country. Both fixed.
• Checkout data no longer lingers in the browser. With persistent checkout form data switched on, saved details sat in browser storage indefinitely. They are now cleared once the order completes.
• Keyboard navigation through the Mega Menu is quiet again. Focusing a menu link with a keyboard or screen reader threw a console error when the regular Menu component was placed in a mobile header row. Gone.
• The Events Calendar archive lays out correctly. Event items were squeezed into the wrong width on the archive page.

Update when you get a chance.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one is pure repair work. Two security holes are closed, scheduled Customizer changes actually go live again, and a run of layout and styling bugs are gone. Nothing new to learn here. Just things behaving the way they always should have.

Let’s get into it.

🔐 Security

• Stored cross-site scripting in the Header Builder account element. The link’s rel value was written into the page as an unquoted HTML attribute, which left room for injected markup to break out and run. Closed.
• Live search could surface post types you never enabled. The search request pulled from post types beyond the ones switched on in the Customizer, so content you had deliberately kept out of search could still come back in results. It now queries only what you’ve enabled.

🐛 Squashed

• Scheduled Customizer changes now actually publish. Scheduling a design change used to fail with a fatal error when WordPress went to apply it in the background. Worse, on setups where it didn’t error outright, the scheduled Astra settings were quietly dropped, and the site just carried on with the old design. Both halves are fixed. Your scheduled change publishes, and it takes effect.
• Dropdown arrows sit back on the same line in Firefox. On some older sites, the top-level arrow dropped onto its own row underneath the menu item. That was a regression from the bigger tap targets added in 4.13.11. Fixed.
• Buttons with no link no longer pretend to be clickable. A Header or Footer Builder button with an empty URL still rendered as a link, hand cursor and all, so visitors clicked something that did nothing. It’s now plain text until you give it a URL.
• Breadcrumb line height works with every breadcrumb source. The setting was being ignored in favour of a fixed default, including when Yoast or Rank Math supplied the breadcrumbs. Your value now applies on the front end.
• The typography dropdown stops collapsing on imported templates. If a template you imported left the line height unit blank, the panel folded up and took Line Height and Letter Spacing with it. Both are reachable again.
• RTL styling is back on Dokan, WooCommerce Cart and Checkout blocks, and LifterLMS. Three right-to-left compatibility stylesheets were returning a 404, so those pages silently lost Astra’s layout fixes. The missing files now ship.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one is small but worth taking. We closed a security hole in Page Headers where the layout setting could be pointed at files it had no business loading. Alongside it: two blank screens are gone, version rollback behaves itself again, and the Blog spacing controls finally explain what they affect.

Let’s get into it.

🔧 Better than before

• Blog spacing controls now tell you what they actually affect. The “Inside” and “Outside” spacing options under Blog Post spell out which container layouts and styles they apply to, so you’re not left guessing why a value did nothing.

🐛 Squashed

• Page Headers can no longer be pointed at arbitrary files on your server. The layout setting accepted any value, so a crafted one could pull in PHP files that were never meant to be templates. It’s now restricted to Astra Pro’s own templates. This is a security fix.
• Rolling back twice in a row now works. Choosing an older version a second time quietly reinstalled the latest one instead of the version you picked. Squashed.
• The Customizer no longer goes blank on locked-down servers. On hosts without direct file write access, opening or saving the Customizer could run out of memory and leave you staring at a white page. Fixed.
• Site Builder Display Conditions opens on layouts with no rules set. An empty display rule set sent you to a blank screen, and it broke the layout settings panel in the editor too. Both gone.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

This release is mostly housekeeping, and the important kind. Two security issues reported through Patchstack are now fixed, both involving markup being saved by people who shouldn’t be able to save it. Editing long pages also got noticeably quicker, and you can finally decide how your trimmed excerpts end.

Let’s get into it.

✨ What’s new

• Decide how your trimmed excerpts end. Blog and archive excerpts now have a Truncation Marker field under Post Elements > Excerpt.
• A filter for Live Search results. Developers can now shape the query behind Live Search with the new astra_live_search_query_args filter. Handy for limiting results to certain post types, excluding categories, or changing how many results come back.

🔧 Better than before

• Editing long pages feels much faster. Astra used to re-sync its layout and background on every keystroke. Now it syncs only when those settings actually change.
• Dropdown arrows are easier to tap. Top-level navigation arrows now meet the WCAG 2.5.8 target size guideline, so they’re far less fiddly on a phone.

🐛 Squashed

• The Header/Footer HTML widget accepted iframes from users who shouldn’t be able to add them. Anyone without the unfiltered_html capability could inject markup that then rendered site-wide. Fixed. (Props: savphill / Patchstack)
• Post meta Divider Type accepted arbitrary markup and printed it unescaped. Same class of problem, different field. Fixed. (Props: Patchstack)
• Starter content is applied more carefully on a fresh install. It now loads only the settings it ships with, and leaves unrelated site options alone.
• The […] excerpt marker showed on the first post only. It now behaves the same on every post in the loop, which by default means it’s hidden.
• WooCommerce product search showed the wrong sidebar. Search results were falling back to your blog sidebar and its widgets instead of the Product Catalog sidebar. A regression from 4.13.9. Fixed.
• Local webfonts returned 404s on Bedrock and other subfolder installs. The font URL was being built from site_url() when it needed home_url(). Fonts load again.
• Child theme palette names no longer get overwritten. Custom color names set in a child theme’s theme.json were being replaced by Astra’s default labels in both the block editor and the Customizer.
• A console error when saving a post twice. With the Custom Fields panel enabled, the second save threw “Cannot read properties of null”. Gone.
• Tapping a submenu arrow followed the parent link. On touch devices, the arrow opened the parent menu item’s link instead of the submenu. It opens the submenu now.
• Update Global Palette through the Abilities API failed. Passing colors caused a fatal error, and colors came back as arrays instead of objects. Both fixed.
• The Starter Templates banner spinner sat crooked. Misaligned next to its label. Straightened.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

Site Builder had a habit of going quiet when something went wrong. A failed request bounced you back to the Astra dashboard with no explanation. A snippet could stop running and never tell you. This release fixes the disappearing acts and clears up an empty My Account menu for WooCommerce Memberships stores.

Let’s get into it.

🔧 Better than before

• You stay on the page when a layout fails to load. Site Builder now shows an inline error with a Retry button instead of quietly sending you back to the Astra dashboard.
• Custom Layouts built with Elementor’s V4 editor look right on the frontend. Atomic element styles now load properly, so what you design is what visitors see.
• The code editor tells you whether your snippet is actually running. A banner at the top of the editor says running or not running. If PHP execution is disabled on your site, you’ll know that’s why nothing happens. If a snippet belongs to someone who is no longer an administrator, or to an account that no longer exists, it says so and points you to the code to review.

🐛 Squashed

• Code editor snippets keep running when the author’s account changes. Demote the person who wrote a snippet to a lower role, or delete their account, and the code used to stop running. It keeps working now, and the editor flags it so you can review it.
• Archive templates using “All Categories Archive” no longer kick you back to the dashboard. A single PHP warning in the layouts response was enough to derail the whole screen. Squashed.
• The layouts screen no longer throws a PHP warning when a layout’s author has been deleted. Gone.
• My Account navigation shows up again on WooCommerce Memberships pages. With Modern My Account View enabled, the members area rendered an empty navigation, leaving customers no way to move between sections. Fixed.
• The “Enable Code Editor” button sits where it should. Its icon was nudged out of line in the layout editor.

Update when you get a chance.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

This one is small and practical. Astra is now tested against WordPress 7.1, so you can update core without wondering whether your theme will keep up. We also cleaned up two rough edges: a misaligned row on the classic WooCommerce Cart page, and an off-looking focus outline in the Customizer color picker.

Let’s get into it.

🔧 Better than before

• Astra is ready for WordPress 7.1. Tested and verified against the latest WordPress release, so updating core is one less thing to worry about.

🐛 Squashed

• The classic Cart page lines up properly again. On WooCommerce’s classic Cart, the coupon code field, the Apply coupon button, and the Update cart button were each rendering at a different height, leaving the whole row looking uneven. Fixed.
• Color palette swatches look right when you select them. Clicking or tabbing to a swatch in the Customizer color picker drew a focus outline at the wrong size. Squashed.

Update when you get a chance.

As always, support is one click away if anything feels off.

— Team Astra