What Astra does on your site
Astra is a classic theme: it provides the layout, header, footer, blog archives and WooCommerce templates, and nearly everything is configured under Appearance > Customize. Global colors and typography, container width, sidebars and a drag-and-drop header and footer builder all live there. In the editor, an “Astra Settings” panel changes the layout of a single page, for example to make it full width for Elementor.
The theme is published by Brainstorm Force, the company behind Spectra, Starter Templates and Ultimate Addons for Elementor. It aims to be lightweight (under 50 KB on the front end, according to the vendor) and works with the major page builders, including Elementor, Beaver Builder and Spectra. Since version 4.13.0 (April 2026), it also ships an MCP server and “abilities” that let an AI assistant read or change the theme settings; both are off by default.
The business model relies on separate plugins. Astra Pro, a paid plugin installed on top of the free theme, adds the sticky header, mega menu, custom layouts with hooks, white labeling and advanced blog and WooCommerce options. Demo sites are imported with the free Starter Templates plugin, which the Astra dashboard offers to install.
Which sites Astra is a good fit for
Astra makes sense when you want a stable base that you will dress up with a page builder or with blocks:
- Sites built with Elementor or another page builder: the theme stays out of the way, and any page can go full width with no title or sidebar.
- Small business sites and blogs: the header and footer builder and the global settings are often enough, with no need to pay for Astra Pro.
- WooCommerce stores: the theme styles the shop, cart and checkout pages and adds a dedicated menu to its dashboard.
- Freelancers who start from a template: Starter Templates imports a complete site that you then adjust.
It is not the best choice if you want to build everything in the WordPress Site Editor: Astra is not a block theme, and its settings stay in the Customizer. If you want a sticky header or a mega menu without paying, compare it with Kadence, which includes a sticky header in its free version.
Astra strengths and limitations
Strengths
- A free header builder. Header and footer are assembled by drag and drop in the Customizer, with a live preview.
- Neutral with page builders. Layout can be set page by page, which leaves room for Elementor, Beaver Builder or Spectra.
- Locally hosted Google Fonts. A free option downloads the fonts to your server instead of loading them from Google.
- Few vulnerabilities in the theme. Four published since 2020, all medium or low severity and all requiring an account.
Limitations
- Sticky header and mega menu cost extra. Both, like the advanced blog layouts, are reserved for Astra Pro.
- Not a block theme. The WordPress Site Editor does not control the header or templates; everything goes through the Customizer.
- An ecosystem of plugins. Demos, advanced blocks and Pro options come from separate plugins, each one to update and monitor.
- License capped at three sites. Astra Pro alone costs $69 per year for 3 sites; beyond that, you need a pricier plan.
The Astra settings we recommend
All of these settings exist in the current free version. The Settings tab is in the dashboard of the Astra admin menu.
| Setting | Recommended value | Why |
|---|---|---|
| Auto-updates Appearance > Themes > Astra (theme details) | Enabled | Security fixes for the theme arrive without waiting for you to log in. |
| Load Google Fonts Locally Astra > Settings > Performance | On if you use a Google font | Your server delivers the font files, so visitors’ browsers no longer call Google on every visit. |
| Preload Local Fonts Same screen | On, then check the display | Fonts load as soon as the page opens; compare a speed test before and after. |
| Enable MCP Server Astra > Settings > MCP | Off (default) | This endpoint is only useful if you connect an AI client to your site, with the MCP Adapter plugin. |
| Enable Abilities Same screen | Off (default) | When on, AI clients can read and change the theme settings; pointless without a real use. |
| Site Accessibility Appearance > Customize > Global > Accessibility | On (default) | A visible outline marks the focused element for visitors who navigate with a keyboard. |
| Rollback to Previous Version Astra > Settings > Version Control | Only for short-term troubleshooting | An older version may contain a flaw fixed since; go back to the latest one as soon as the problem is solved. |
- After enabling local fonts, view a page’s source: no
fonts.googleapis.comaddress should appear. - If you change fonts, click “Flush Local Fonts Cache” in Astra > Settings > Performance.
- Once the site is imported, deactivate and delete Starter Templates if you no longer use it.
- With Astra Pro, check under Plugins that its updates actually arrive: they come through your Brainstorm Force account, not wordpress.org.
Astra security: a lightly exposed theme, a busier ecosystem
The theme itself has few published vulnerabilities, all code or style injections by a logged-in user (see our definition of an XSS vulnerability):
- CVE-2024-29768, fixed in 4.6.5: stored XSS exploitable by an Editor account (CVSS 5.9).
- CVE-2024-2347, fixed in 4.6.9: stored XSS through a user’s display name, with a Contributor account (CVSS 6.4).
- CVE-2026-3534, fixed in 4.12.4: stored XSS through a page’s background settings, with a Contributor account (CVSS 6.4).
- CVE-2026-27085, fixed in 4.14.0: content injection by a WooCommerce Shop Manager (CVSS 2.7).
The changelog also lists fixes without a CVE record, including one in 4.14.2 that stops a Contributor from reading other users’ draft titles through the AI abilities. The serious flaws in the ecosystem mostly hit Astra Pro, Starter Templates and Spectra: the full timeline is in our article on Astra theme security, and our guide to automatic updates helps you apply them without breaking anything. The free version of WP Masquerade removes the version number Astra writes into a class on every page, which makes the site harder to spot for bots targeting these flaws, without replacing the update.
What WP Masquerade hides for Astra
Free version Handled by the free version of WP Masquerade
Astra is one of the 50 most used plugins known to the free version. Pro goes further by renaming its files.
Free version
- version number in a class
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- JavaScript variables
astra - CSS classes
ast-*, astra-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Astra FAQ
Is the free version of Astra enough?
For a business site, a blog or a site built with Elementor, often yes: the header and footer builder, global settings and WooCommerce integration are free. Astra Pro is worth it if you need a sticky header, a mega menu, custom layouts with hooks or white labeling.
How much does Astra Pro cost?
The pricing page lists Astra Pro alone at $69 per year for 3 sites, plus a lifetime license. The Astra Pro + AI plan costs $149 per year ($99 the first year), also for 3 sites; every plan comes with a 14-day money-back guarantee.
Should I keep Starter Templates after importing a template?
No, if you are done importing templates: the imported site keeps working without the plugin. Removing it means one less plugin to update.
Does Astra work with the WordPress Site Editor?
No: Astra is a classic theme, configured in the Customizer. If you want to edit the header and templates in the Site Editor, pick a block theme such as Twenty Twenty-Five.