---
title: "Blocksy"
description: "Blocksy theme free or Pro: strengths, limitations, pricing, recommended settings (fonts, Schema.org, Analytics) and Blocksy Companion vulnerabilities."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/blocksy/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T21:00:09+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/blocksy/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/blocksy/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/blocksy/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/blocksy/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/blocksy/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/blocksy/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/blocksy/index.md"
---

# Blocksy

Blocksy is a free WordPress theme configured in the Customizer, with a complete header builder and a companion plugin that adds many of its features. Our take on the theme and Blocksy Pro, the performance settings to choose and the vulnerabilities to know about.

## The essentials

- Best for blogs, business sites or stores that want a full-featured header without paying for it.
- Main caveat: the sticky header and starter sites rely on Blocksy Companion, which you must keep updated.
- Free; Pro starts at $69 a year for one site, $149 a year for unlimited sites, or $199 lifetime.

## What the Blocksy theme does on your site

Blocksy is a classic theme: it handles the layout, header, footer, archives and WooCommerce templates, and almost everything is configured under Appearance > Customize. You get a drag-and-drop header and footer builder, a global color palette, typography controls, per-post-type layouts, breadcrumbs and a Performance panel. The theme is designed for the block editor and also works with Elementor, Brizy and Beaver Builder.

Part of the free feature set lives in a separate plugin, Blocksy Companion, which the developer, Creative Themes, also publishes on wordpress.org. It adds the sticky and transparent header, starter sites, dynamic blocks, OpenGraph meta data, a Google Analytics v4 field and four free extensions: Cookies Consent, Newsletter Subscribe, Trending Posts and Product Reviews.

The business model is Blocksy Pro, sold as a yearly or lifetime license: conditional headers and footers, content blocks hooked into theme locations, mega menus, custom fonts and locally hosted Google Fonts, multiple sidebars, code snippets, dark mode and white labeling. The advanced store options (Shop Extra) and post type options (Post Types Extra) start with the Business plan.

![Diagram: Blocksy works on visitors and bots, wordpress, database and files. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/blocksy/diagram-en.svg?v=aaa42262)

## Which sites Blocksy is a good fit for

Blocksy makes sense when you want a full-featured theme that is quick to learn, with an inexpensive Pro version:

- **Blogs and business sites built with the block editor**: the header builder, global settings and Blocksy Companion blocks are often all you need.
- **WooCommerce stores**: product archives, the single product page and general store settings each have their own Customizer panel.
- **Agencies and freelancers**: the Agency plan covers unlimited sites and includes white labeling.
- **Sites with accessibility requirements**: the theme carries the wordpress.org “accessibility-ready” tag.

It is not the best pick if you want to build everything in the WordPress Site Editor: Blocksy remains a classic theme. If you want a leaner base with no companion plugin, compare it with [GeneratePress](https://www.wp-masquerade.com/features/camouflaged-plugins/generatepress/); [Kadence](https://www.wp-masquerade.com/features/camouflaged-plugins/kadence/) is the closest alternative, with a free header builder of its own.

## Blocksy strengths and limitations

### Strengths

- **A free header builder.** Drag and drop, a mobile version, plus sticky and transparent headers at no cost with Blocksy Companion.
- **System fonts by default.** Until you pick a Google font, the theme makes no calls to Google’s servers.
- **Useful free extensions.** A cookie banner, a newsletter form and trending posts; the Google Analytics v4 code entered in Blocksy waits for consent when the banner is on.
- **An affordable Pro version.** $69 per year for one site, $149 per year for unlimited sites, or a lifetime license from $199.

### Limitations

- **A near-mandatory companion plugin.** The sticky header, starter sites and cookie banner all rely on Blocksy Companion, which has had serious vulnerabilities.
- **Local fonts and mega menus cost extra.** Hosting Google Fonts locally, mega menus, conditional headers and dark mode require Pro.
- **A limited Personal plan.** It leaves out Shop Extra, Post Types Extra and the Pro starter sites, which come with the Business and Agency plans.
- **A classic theme.** Settings stay in the Customizer rather than in the WordPress Site Editor.

## The Blocksy settings we recommend

These settings exist in the current free theme and in Blocksy Companion, under Appearance > Customize. Publish each change, then run the checks below.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Disable Emojis Script**  Customize > Performance | On (default) | Removes the WordPress emoji script; modern browsers render emojis on their own. |
| **Lazy Load Images**  Same panel | On (default) | If an optimization plugin already lazy loads images, keep only one of the two. |
| **Dynamic CSS Output**  Same panel (with Blocksy Companion) | File (default) | The CSS generated from your settings goes into a static file instead of the head of every page. |
| **Base Font**  Customize > Typography | System Default, unless you need otherwise | A Google font is loaded from Google’s servers; hosting it locally requires the Pro Local Google Fonts extension. |
| **Schema.org Markup**  Customize > General > Visitor Engagement | Off if your SEO plugin handles it | The setting’s own description suggests turning it off when an SEO plugin manages your [structured data](https://www.wp-masquerade.com/glossary/structured-data/). |
| **OpenGraph Meta Data**  Same panel (with Blocksy Companion) | Off (default) with an SEO plugin | SEO plugins already output these sharing tags; turn it on only if you have none. |
| **Google Analytics v4**  Same panel (with Blocksy Companion) | Empty if another tool already adds Analytics | A single tracking code avoids double counting; with Cookies Consent active, Blocksy waits for the visitor’s consent. |
| **Sticky Functionality**  Customize > Header > General tab | Depends on the site | Off by default; useful with a long menu, but test on a phone that the header does not cover the content. |

- In Plugins, check that Blocksy Companion is at least version 2.1.59 and turn on its auto-updates.
- View a page’s source: with no Google font selected, no `fonts.googleapis.com` address should appear.
- After changing the Schema.org markup setting, check a page with Google’s Rich Results Test.
- Only import a starter site on a fresh install or a staging site: the import adds content, settings and plugins.

## Blocksy security: the theme, and above all its companion plugin

The theme’s own flaws mostly involve the `blocksy_meta` fields and require a contributor account. Blocksy Companion’s are more serious, including two that need no account at all:

- **CVE-2026-8365, theme, fixed in 2.1.42**: PHP object injection through the `blocksy_meta` REST API field (CVSS 8.8).
- **CVE-2026-2583, theme, fixed in 2.1.31**: stored XSS through the same `blocksy_meta` fields.
- **CVE-2025-12846, Companion, fixed in 2.1.20**: an author account could upload arbitrary files by bypassing the SVG check (CVSS 9.1).
- **Companion, fixed in 2.1.47**: unauthenticated arbitrary file upload, rated 10 out of 10 by Patchstack.
- **CVE-2026-107645, Companion, fixed in 2.1.59**: on a store running Dokan, a visitor with no account could create a vendor account and get logged into it (CVSS 9.1).

The developer patches quickly and runs a disclosure program with Patchstack: turn on auto-updates for the theme and for Blocksy Companion (see our guide to plugin auto-updates). The full timeline is in our article on [Blocksy and Blocksy Companion vulnerabilities](https://www.wp-masquerade.com/blocksy-theme-security-vulnerabilities/), and the Dokan-related flaw is covered in [a dedicated article](https://www.wp-masquerade.com/blocksy-companion-vulnerability-cve-2026-107645/). WP Masquerade Pro renames the theme and Blocksy Companion folders along with the `blocksy` and `ct` IDs of their scripts and stylesheets, while the `blocksyJsonP` variable and the `ct-*` classes remain visible: that makes the site harder for bots to profile, but it does not replace updating.

## Blocksy FAQ

**Do I need to install Blocksy Companion with the theme?**

It is not required, but without it you lose the sticky header, starter sites, dynamic blocks and the free extensions. If you install it, keep it updated: it is where the most serious flaws have been.

**Is the free Blocksy theme enough?**

For most blogs and business sites, yes. Pro is mainly worth it for conditional headers, mega menus, hooked content blocks or locally hosted Google Fonts.

**How much does Blocksy Pro cost?**

The official pricing page lists $69 per year for one site (Personal), $99 for ten sites (Business) and $149 for unlimited sites (Agency). Lifetime licenses cost $199, $299 and $499, with a 14-day money-back guarantee.

**Does Blocksy work with the WordPress Site Editor?**

No: it is a classic theme, configured in the Customizer. It is, however, built for the block editor, where you create your page content.

## Key facts

- Category: Builders and themes
- Vendor: Creative Themes
- Price: Free; Blocksy Pro from $69 per year for one site, or $199 for a lifetime license
- Active installations (wordpress.org): 300 000+
- Version: 2.1.61
- Official page: https://wordpress.org/themes/blocksy/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only
- With Pro: folder name, tag IDs
- Still visible: JavaScript variables, CSS classes