What's New with Astra

Hey everyone 👋

This release is about speed, Modern Checkout, and tightening a Site Builder privacy gap. We’ve trimmed scripts and styles so your admin and checkout screens load lighter, chased down a long list of Modern Checkout rough edges — mobile and desktop — and locked down layout data that was quietly reachable through REST, search and feeds. A handful of theme-builder, Page Header and theme-switching bugs are gone too.

Let’s get into it.

🚀 Improved

• Site Builder scripts only load where they’re needed. The Site Builder admin assets used to load across every WordPress admin screen. Now they only load on the Site Builder page itself, so every other admin page feels lighter.
• One fewer script on Two Step Checkout. The Two Step Checkout page was pulling in an unused slider script on every load. We’ve dropped it, so your checkout page makes fewer requests.
• No more waiting on a loopback that never comes. The addon used to fire off a blocking WP-Cron loopback request on every admin and frontend page load. On sites that can’t reach their own URL — local setups, strict firewalls, hosts with reverse-proxy quirks — that meant a quiet delay on every page. The blocking call is gone.
• jQuery Migrate is no longer a front-end dependency. Astra Pro doesn’t rely on jQuery Migrate on the front end anymore, so you can safely remove it for faster page loads and better Lighthouse scores.

🐛 Squashed

• Elementor Pro theme-builder templates keep their styling. Elementor Pro Theme Builder templates — like a Single Post template — were losing their Atomic Widgets styles on posts that also used a Site Builder layout. Both now coexist cleanly.
• Variation gallery images refresh with slider layouts (WooCommerce 10.8+). Variation gallery images and thumbnails now update correctly when you’re using the Horizontal or Vertical Slider product gallery layouts on WooCommerce 10.8 and later.
• Modern Checkout mobile order summary behaves itself. The mobile order summary had a handful of nasty quirks: content was getting cut off, the page refreshed repeatedly when the shipping method changed, and the button label was wrong after clicking the login link. All three are fixed.
• Modern Checkout shipping methods are selectable on desktop. Shipping method names weren’t clickable on desktop. They are now.
• Modern Checkout fields stay responsive in Dokan and friends. On some multi-vendor marketplace setups like Dokan, checkout fields could stop responding on mobile. They stay interactive now.
• No more PHP warnings when a checkout field has no label. If a plugin or custom code added a checkout field without a label, the Modern Checkout page would log a PHP warning. It no longer does.
• Two Step Modern Checkout accepts real email addresses. Valid addresses with a plus sign, an apostrophe, or a longer TLD like .info were being rejected at step one. Shoppers can now get through to step two.
• Quick View respects password-protected products. Quick View was leaking the short description of password-protected products to visitors who hadn’t entered the password. The password form shows instead now, as it should.
• Page Headers pass accessibility audits again. A Page Header with a background image was producing invalid ARIA markup that tripped Lighthouse and axe. The markup is now valid.
• LearnDash + Header Builder: no more phantom option. The Display Student’s Gravatar in Primary Header option no longer shows up in the Customizer when the Header Builder is active (where it couldn’t do anything anyway).
• LifterLMS + Header Builder: same treatment. The Enable Header Profile Link option no longer appears in the Customizer when the Header Builder is active.
• App-aware theme switchers no longer crash the site. If a plugin like AppPresser swapped the active theme for app requests, Astra Pro could throw a fatal on those pages. They load normally now.

🔒 Secured

• Site Builder layouts stay private. Visitors and non-admin users could previously reach Site Builder layouts and their display rules through the REST API, site search, RSS feeds and archive URLs. All of those paths are now locked down to the right roles only.

Update when you can — the security fix is worth doing promptly, and the performance wins are a bonus on top. Let us know if anything looks off.

— Team Astra

Hey everyone 👋

Short, focused release this time. We shaved a quiet delay off every admin and frontend page load, cleaned up a few Customizer and accessibility rough edges, and closed a draft-privacy gap that could expose private post titles.

Let’s get into it.

🚀 Improved

• No more waiting on a loopback that never comes. The theme used to fire off a blocking WP-Cron loopback request on every admin and frontend page load. On sites that can’t reach their own URL — local setups, strict firewalls, hosts with reverse-proxy quirks — that meant a quiet delay on every page. We’ve dropped the blocking call, so pages load clean.

🐛 Squashed

• Resetting a header or footer border color actually resets it now. Hitting reset on a border or separator color in the Customizer used to save it as empty — which meant the border quietly vanished after publishing. It now resets to the intended default so the border stays visible.
• Screen reader cart counts read like English again. The header cart link now reads “1 item” instead of “1 items” when there’s a single product in the cart. The label is also properly translatable now, so it works correctly in every locale.
• Live preview edit icons line up on RTL sites. Customizer live preview edit icons and section outlines were slightly misaligned on right-to-left layouts. Fixed.

🔒 Secured

• Contributors can no longer peek at other people’s drafts. The post meta abilities system had a gap where a Contributor could read the titles and Astra layout settings of drafts and private posts belonging to other users. Tightened up — those stay private now.

That’s it. Update, enjoy slightly snappier page loads, and ping us if anything feels off.

— Team Astra

Hey everyone 👋

This release leans into security. We tightened up Modern Checkout, Site Builder, and Page Headers, and refreshed the bundled sanitizer library. On top of that, custom layouts got a lot more flexible, the Mega Menu is friendlier for screen readers, and a handful of WooCommerce and Customizer annoyances are gone.

Let’s get into it.

✨ What’s new

• One layout, placed on many hooks. Custom layouts built with the Hooks layout can now sit on several predefined and custom hooks at once.
• What that means for you:
  • No more duplicating the same layout just to show it in two places.
  • Build your content once, then point it wherever it needs to appear.
  • Fewer layouts to manage as your site grows.
• Learn how it works (https://wpastra.com/docs/custom-layout-hooks/)

🔧 Better than before

• Sticky Logo Width now works with the Shrink effect. You can set exactly how small your logo gets when the header shrinks on scroll.
• The Mega Menu is easier to navigate. Submenu toggle arrows now announce their menu item to screen readers, and Disable Link mega menus open on click.
• Modern Checkout fields look cleaner. Fields are a touch taller, and the Country and State dropdowns line up and show their labels like every other field.
• Rollback is clearer when there’s nothing to roll back to. The dropdown stays visible but inactive, with a tooltip explaining why.
• Better YITH Pre-Order compatibility. Out-of-stock products offered as pre-orders now add to the cart with Slide In Cart, Redirect to Cart/Checkout, and Quick View.

🐛 Squashed

• Slide In Cart no longer freezes the page. Adding a product with the Single Product Slide In Cart action used to lock scrolling when the header Cart Click Action was set to Cart Page. Fixed.
• Grouped products with large IDs add to cart again. They were silently failing with AJAX actions like Slide In Cart. Gone.
• The sticky logo resizes smoothly. With the Shrink effect on, the logo now scales in step with the rest of the header instead of snapping.
• Live preview keeps up with font changes. Blog and archive post titles now update in the Customizer preview the moment you switch the Body or Headings font.
• Complex image URLs load fully. Page Header background images with more than one query parameter, like CDN or signed URLs, now keep all their parameters.

🔒 Security

• Comments and previous posts are locked down. Comments shown through Custom Layouts no longer run shortcodes, and Auto Load Previous Post only pulls pages from your own site. (Props to savphill / Patchstack.)
• Modern Checkout logins stay secure on HTTPS. Session cookies set when logging in from the Modern Checkout page are now marked secure.
• The checkout email check gives nothing away. It no longer hints at whether an account exists when Modern Checkout isn’t in use, or when checkout login and account creation are turned off.
• Custom layout shortcodes respect permissions. The shortcode only renders layouts a visitor is allowed to see, and code editor snippets can no longer be changed through custom fields.
• Page Headers are admin-only now. Only administrators can manage them, and their color, size, and image settings are validated before use. Your existing Page Headers keep working.
• Updated the bundled sanitizer library. DOMPurify moved to 3.4.17, picking up upstream fixes for several HTML sanitization bypasses (CVE-2026-0540).

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one’s all about polish. We tracked down a mix of annoyances across WooCommerce, menus, the Customizer, and accessibility, including one that could cut a page off mid-load. Nothing you have to relearn. Just things working the way they should.

Let’s get into it.

🐛 Squashed

• Slide In Cart now opens when your header cart points to the Cart page. Adding a product from the shop, an archive, or any product list wasn’t triggering the Slide In Cart if the header Cart Click Action was set to “Cart Page.” It opens every time now.
• A bad menu add-on can no longer take your whole page down. If a plugin or custom walker passed the wrong kind of value to the menu link filter, it threw a fatal error that cut the page off halfway through loading. That path is guarded now, so the page keeps rendering.
• Submenu toggles finally make sense to screen readers. Expandable menu items now announce which item they control and whether they’re open or closed. As a bonus, anything added after a menu link (like Mega Menu content) is left untouched instead of getting rewritten.
• Archive banner text is translatable again in WPML. Custom titles and descriptions for your Blog and post-type archives, WooCommerce catalog, EDD, and SureCart pages now show up in WPML String Translation.
• Live Search results look right on phones and tablets. On right-to-left sites, the results dropdown was rendering as a squeezed, broken list on archive pages with pagination. Fixed.
• The Posts page editor only shows settings that actually apply. Container, Sidebar, and Advanced Settings no longer appear when you’re editing your blog’s Posts page, since they don’t affect the listing anyway.
• Setting Body font back to Default shows the real default font. The live preview was falling back to a serif font instead of your system default. Now the preview matches what visitors see.
• Closing the Slide In Cart with Esc behaves properly. Pressing Esc used to throw a console error. Now it closes the cart cleanly and sends focus back to the cart icon, exactly where keyboard users expect it.

We think you’ll like this one. Update when you’re ready.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

Astra’s Global Palette has always given you nine colors to work with. Now you can add your own on top of those, give them real names, and use them everywhere you already pick colors. We also closed three security issues and smoothed out a few things for WooCommerce and Easy Digital Downloads stores.

Let’s get into it.

✨ What’s new

• Your own named colors in the Global Palette
  • There’s a new + button under Global > Colors. Click it and add a color that’s yours, on top of the nine Astra ships.

• What that means for you:
  • Name your colors something you’ll actually recognise, like “Brand Teal” or “Footer Grey”, instead of hunting for a hex code every time
  • They show up in the block editor, in Elementor, and in every Astra color picker, so there’s one list of colors everywhere
  • Change a color once and everything using it updates across the site
  • Add up to nine of your own. Remove one and its value is kept, so adding it back later restores exactly what you had

→ Learn how it works

🔧 Better than before

• WooCommerce shops do less work on every page load. Astra was sending the same cart refresh request twice, once on page load and again after add to cart. The duplicates are gone, so there’s less load on your server, especially on busy stores.

🐛 Squashed

• Live Search no longer trusts what’s in a post title. A carefully crafted title could run script in a visitor’s browser when it appeared in search results. Squashed.
• Background settings can’t leak into your stylesheet. Page and content background values saved by someone with limited editing access could inject their own rules into the front-end CSS. They’re sanitized properly now.
• Author avatars handle odd post titles safely. On blog and archive pages, markup inside a post title could break out of the avatar’s alt text. Gone.
• No more blank gap on Easy Digital Downloads pages. On a fresh install, single download pages rendered an empty sidebar-width space until you opened the download and saved its Sidebar Layout once. Fixed.
• Anchor links stay shareable when Smooth Scroll is on. With “Smooth Scroll to ID” enabled, clicking a section link scrolled you to the right place but left the URL alone, so the link you copied went nowhere. The #hash now updates after the scroll, and reloading lands you back in the same spot.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one is almost entirely for store owners. Your cart drawer opens the moment you add a product, your checkout stops forgetting things customers already typed, and product galleries no longer show a thumbnail that was never meant to be there. Two fixes outside WooCommerce round it out.

Let’s get into it.

🔧 Better than before

• The Slide In Cart opens the instant you add a product. Astra was sending the same cart refresh request twice on every add-to-cart. One of them is gone, so the drawer slides open right away instead of waiting on a duplicate round trip.

🐛 Squashed

• Product galleries no longer show a stray thumbnail. When a product used the same image for its main photo and its gallery, the Vertical Slider and Horizontal Slider layouts rendered a misplaced thumbnail strip beside it. Those products now show a single image, matching how WooCommerce 11.1 handles it.
• Saved checkout details come back the way customers left them. A third-party checkout field with no name could quietly stop the whole restore, and the State field was dropped whenever a customer switched country. Both fixed.
• Checkout data no longer lingers in the browser. With persistent checkout form data switched on, saved details sat in browser storage indefinitely. They are now cleared once the order completes.
• Keyboard navigation through the Mega Menu is quiet again. Focusing a menu link with a keyboard or screen reader threw a console error when the regular Menu component was placed in a mobile header row. Gone.
• The Events Calendar archive lays out correctly. Event items were squeezed into the wrong width on the archive page.

Update when you get a chance.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one is pure repair work. Two security holes are closed, scheduled Customizer changes actually go live again, and a run of layout and styling bugs are gone. Nothing new to learn here. Just things behaving the way they always should have.

Let’s get into it.

🔐 Security

• Stored cross-site scripting in the Header Builder account element. The link’s rel value was written into the page as an unquoted HTML attribute, which left room for injected markup to break out and run. Closed.
• Live search could surface post types you never enabled. The search request pulled from post types beyond the ones switched on in the Customizer, so content you had deliberately kept out of search could still come back in results. It now queries only what you’ve enabled.

🐛 Squashed

• Scheduled Customizer changes now actually publish. Scheduling a design change used to fail with a fatal error when WordPress went to apply it in the background. Worse, on setups where it didn’t error outright, the scheduled Astra settings were quietly dropped, and the site just carried on with the old design. Both halves are fixed. Your scheduled change publishes, and it takes effect.
• Dropdown arrows sit back on the same line in Firefox. On some older sites, the top-level arrow dropped onto its own row underneath the menu item. That was a regression from the bigger tap targets added in 4.13.11. Fixed.
• Buttons with no link no longer pretend to be clickable. A Header or Footer Builder button with an empty URL still rendered as a link, hand cursor and all, so visitors clicked something that did nothing. It’s now plain text until you give it a URL.
• Breadcrumb line height works with every breadcrumb source. The setting was being ignored in favour of a fixed default, including when Yoast or Rank Math supplied the breadcrumbs. Your value now applies on the front end.
• The typography dropdown stops collapsing on imported templates. If a template you imported left the line height unit blank, the panel folded up and took Line Height and Letter Spacing with it. Both are reachable again.
• RTL styling is back on Dokan, WooCommerce Cart and Checkout blocks, and LifterLMS. Three right-to-left compatibility stylesheets were returning a 404, so those pages silently lost Astra’s layout fixes. The missing files now ship.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

Team Astra

Hey everyone 👋

This one is small but worth taking. We closed a security hole in Page Headers where the layout setting could be pointed at files it had no business loading. Alongside it: two blank screens are gone, version rollback behaves itself again, and the Blog spacing controls finally explain what they affect.

Let’s get into it.

🔧 Better than before

• Blog spacing controls now tell you what they actually affect. The “Inside” and “Outside” spacing options under Blog Post spell out which container layouts and styles they apply to, so you’re not left guessing why a value did nothing.

🐛 Squashed

• Page Headers can no longer be pointed at arbitrary files on your server. The layout setting accepted any value, so a crafted one could pull in PHP files that were never meant to be templates. It’s now restricted to Astra Pro’s own templates. This is a security fix.
• Rolling back twice in a row now works. Choosing an older version a second time quietly reinstalled the latest one instead of the version you picked. Squashed.
• The Customizer no longer goes blank on locked-down servers. On hosts without direct file write access, opening or saving the Customizer could run out of memory and leave you staring at a white page. Fixed.
• Site Builder Display Conditions opens on layouts with no rules set. An empty display rule set sent you to a blank screen, and it broke the layout settings panel in the editor too. Both gone.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

— Team Astra

Hey everyone 👋

This release is mostly housekeeping, and the important kind. Two security issues reported through Patchstack are now fixed, both involving markup being saved by people who shouldn’t be able to save it. Editing long pages also got noticeably quicker, and you can finally decide how your trimmed excerpts end.

Let’s get into it.

✨ What’s new

• Decide how your trimmed excerpts end. Blog and archive excerpts now have a Truncation Marker field under Post Elements > Excerpt.
• A filter for Live Search results. Developers can now shape the query behind Live Search with the new astra_live_search_query_args filter. Handy for limiting results to certain post types, excluding categories, or changing how many results come back.

🔧 Better than before

• Editing long pages feels much faster. Astra used to re-sync its layout and background on every keystroke. Now it syncs only when those settings actually change.
• Dropdown arrows are easier to tap. Top-level navigation arrows now meet the WCAG 2.5.8 target size guideline, so they’re far less fiddly on a phone.

🐛 Squashed

• The Header/Footer HTML widget accepted iframes from users who shouldn’t be able to add them. Anyone without the unfiltered_html capability could inject markup that then rendered site-wide. Fixed. (Props: savphill / Patchstack)
• Post meta Divider Type accepted arbitrary markup and printed it unescaped. Same class of problem, different field. Fixed. (Props: Patchstack)
• Starter content is applied more carefully on a fresh install. It now loads only the settings it ships with, and leaves unrelated site options alone.
• The […] excerpt marker showed on the first post only. It now behaves the same on every post in the loop, which by default means it’s hidden.
• WooCommerce product search showed the wrong sidebar. Search results were falling back to your blog sidebar and its widgets instead of the Product Catalog sidebar. A regression from 4.13.9. Fixed.
• Local webfonts returned 404s on Bedrock and other subfolder installs. The font URL was being built from site_url() when it needed home_url(). Fonts load again.
• Child theme palette names no longer get overwritten. Custom color names set in a child theme’s theme.json were being replaced by Astra’s default labels in both the block editor and the Customizer.
• A console error when saving a post twice. With the Custom Fields panel enabled, the second save threw “Cannot read properties of null”. Gone.
• Tapping a submenu arrow followed the parent link. On touch devices, the arrow opened the parent menu item’s link instead of the submenu. It opens the submenu now.
• Update Global Palette through the Abilities API failed. Passing colors caused a fatal error, and colors came back as arrays instead of objects. Both fixed.
• The Starter Templates banner spinner sat crooked. Misaligned next to its label. Straightened.

We recommend updating as soon as you can.

As always, support is one click away if anything feels off.

— Team Astra