{
    "title": "CoBlocks",
    "seo_title": "CoBlocks: review, recommended settings and limits",
    "h1": "CoBlocks",
    "description": "CoBlocks, GoDaddy’s free blocks: strengths, limitations, recommended settings (typography, form, reCAPTCHA, map) and patched vulnerabilities.",
    "lead": "CoBlocks, GoDaddy’s free plugin, adds galleries, a form, a restaurant menu, a pricing table and resizable rows to the block editor. Our take on whether it still fits your site, the editor, form and map settings to choose, and the patched vulnerabilities worth knowing.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/coblocks/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/coblocks/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/coblocks/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/coblocks/index.json",
    "published": "2026-11-05T08:00:00+00:00",
    "modified": "2026-11-05T21:03:23+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "CoBlocks",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/coblocks/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/coblocks/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/coblocks/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "CoBlocks",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/coblocks/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/coblocks/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/coblocks/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "CoBlocks",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/coblocks/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/coblocks/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/coblocks/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "CoBlocks",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/coblocks/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/coblocks/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/coblocks/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "CoBlocks",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/coblocks/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/coblocks/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/coblocks/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "CoBlocks",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/coblocks/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/coblocks/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/coblocks/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "CoBlocks",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/coblocks/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/coblocks/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/coblocks/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "CoBlocks"
        },
        {
            "level": 2,
            "text": "What CoBlocks does on your site"
        },
        {
            "level": 2,
            "text": "Which sites CoBlocks still suits"
        },
        {
            "level": 2,
            "text": "CoBlocks strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The settings we recommend for CoBlocks"
        },
        {
            "level": 2,
            "text": "CoBlocks security: stored XSS flaws fixed by updating"
        },
        {
            "level": 2,
            "text": "Frequently asked questions about CoBlocks",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for maintaining a site already built with its blocks, or adding galleries and a menu for free.\n- Main caveat: slow development, Google-hosted fonts and a form that stores nothing.\n- Free, with no paid edition: every block and setting is included.\n\n## What CoBlocks does on your site\n\nCoBlocks adds about thirty content and layout blocks to the WordPress block editor: resizable rows and columns with per-device margin and padding, accordion, alert, FAQ, counter, pricing table, services, features, social profiles, social sharing, shape divider, Google Maps, a form, and five galleries (carousel, collage, masonry, offset, stacked) with a lightbox. More specialized blocks target small businesses: a restaurant menu (Food & Drinks), OpenTable reservations and Events, which can display a calendar from an external iCal feed.\n\nThe plugin also adds typography controls (font, size, weight, line height) that apply to its own blocks and to several core blocks such as Paragraph, Heading, Button and List, plus animations and gradients. An “Editor settings” screen in the editor’s Options menu lets you switch these controls off one by one. You can also save a selection of blocks as a reusable pattern (“Add Design Pattern” in the block toolbar menu, listed under the Appearance menu).\n\nThe developer is GoDaddy, which also publishes the free Go theme and presents it as the companion theme. CoBlocks is entirely free: there is no Pro version or paid add-on, and the official FAQ says it will stay that way. The flip side is slow development: since 2025, releases have been rare and mostly bug fixes, and the changelog in the readme file stops at version 3.1.15 even though newer versions have shipped.\n\n![Diagram: CoBlocks works on visitors and bots, wordpress, database and files. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/coblocks/diagram-en.svg?v=91c0aaa9)\n\n## Which sites CoBlocks still suits\n\nCoBlocks still makes sense when you want a few useful blocks on top of the native editor, without paying anything:\n\n- **Sites already built with CoBlocks**: your pages rely on its blocks, and keeping it updated costs less than rebuilding everything.\n- **Restaurants and small shops**: menu, OpenTable reservations, map, pricing table and contact form cover a simple business page.\n- **Portfolios and photo sites**: the five galleries and the lightbox save you a separate gallery plugin.\n- **Sites on the Go theme**: theme and plugin come from the same developer and are designed to work together.\n\nIt is not the best pick for an ambitious new project: no header building, no bundled design library, no dynamic content or conditional display, and a slow update pace. Our [WordPress page builder comparison](https://www.wp-masquerade.com/best-wordpress-page-builders-compared/) helps you choose a more complete tool, and [Spectra](https://www.wp-masquerade.com/features/camouflaged-plugins/spectra/) is a free, more actively developed alternative in the same space.\n\n## CoBlocks strengths and limitations\n\n### Strengths\n\n- **Completely free.** Every block and setting is included, with no paid version and no locked features.\n- **Uncommon business blocks.** Restaurant menu, OpenTable reservations, iCal calendar and five galleries in a single plugin.\n- **Controls on core blocks too.** Typography applies to Paragraph, Heading, Button, List and Cover, not just CoBlocks blocks.\n- **An editor you can slim down.** Typography, animations, custom colors and gradients can be turned off in Editor settings.\n\n### Limitations\n\n- **Development has slowed down.** Few releases since 2025, and mostly fixes rather than new features.\n- **Content tied to the plugin.** The editor no longer recognizes `coblocks/*` blocks if you deactivate CoBlocks.\n- **Fonts loaded from Google.** A font picked with its typography controls is served from `fonts.googleapis.com`, with no local loading option.\n- **A bare-bones form.** Submissions go out by email, with no storage in WordPress and no email marketing integration.\n\n## The settings we recommend for CoBlocks\n\nCoBlocks has no settings page in the admin. The general options live in the block editor, under the Options menu (the three dots at the top right) > Editor settings; service keys are in the sidebar of the Form and Map blocks.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Automatic updates**  Plugins > CoBlocks | On | Recent releases are almost all fixes, several of them security fixes. |\n| **Typography controls**  Options > Editor settings > General | Off if your theme handles fonts | Avoids Google-hosted fonts in new content and keeps typography consistent. |\n| **Custom color pickers**  Options > Editor settings > General | Off on a site with brand guidelines | Writers stick to the theme palette. |\n| **Animation controls**  Options > Editor settings > General | Depends on the site | Turn them off if you never animate blocks: the editor stays simpler. |\n| **Google reCAPTCHA** (Site key, Secret key) Form block > sidebar | Your reCAPTCHA v3 keys | The form already has a honeypot field; reCAPTCHA also filters automated submissions. |\n| **Email address**  Form block > Form settings | An inbox someone checks daily | Without an address, submissions go to the site admin email. |\n| **Google Maps API key**  Map block > sidebar | A key restricted to your domain | The key is visible in the page source; a restriction on Google’s side limits its use by other sites. |\n\n- Send a test message from every form and check that it arrives, including in the spam folder.\n- View the source of a page that uses a CoBlocks font: a `fonts.googleapis.com` address means a Google request that belongs in your privacy policy.\n- If you use the Events block with an external iCal feed, make sure the source is trustworthy and the plugin is up to date.\n- In Users, check who has the Contributor or Author role: that is the account level most of the plugin’s vulnerabilities require.\n\n## CoBlocks security: stored XSS flaws fixed by updating\n\nWPScan lists eight vulnerabilities fixed since 2024. The dominant family is the stored XSS vulnerability: a contributor account plants a script in a poorly escaped block attribute, which then runs for visitors or administrators. The cases worth knowing:\n\n- **CVE-2026-4801, versions up to 3.1.16**: stored XSS through the titles, descriptions and locations of an external iCal feed displayed by the Events block, with a contributor account (CVSS 6.4).\n- **CVE-2026-27094, fixed in 3.1.17**: another stored XSS that affected versions up to 3.1.16 (CVSS 6.5).\n- **CVE-2025-24751, fixed in 3.1.14**: a missing authorization check (CVSS 4.3).\n- **CVE-2024-7132, fixed in 3.1.13**: stored XSS possible for an editor account even without the `unfiltered_html` capability, for example on multisite.\n- **CVE-2024-4260, fixed in 3.1.12**: a [server-side request forgery](https://www.wp-masquerade.com/glossary/ssrf/) (SSRF) that let a contributor make the server contact arbitrary hosts through shortcodes.\n\nSo turn on automatic updates for CoBlocks (see our guide to automatic plugin updates) and give the Contributor role only to people you trust. WP Masquerade Pro removes the `coblocks` folder name from file addresses and renames the stylesheet and script IDs, but the `wp-block-coblocks-*` classes stay visible: it makes the plugin harder for bots to spot, without replacing updates.\n\n## Frequently asked questions about CoBlocks\n\n**Is CoBlocks really free?**\n\nYes. There is no paid version: every block and setting is in the plugin published on wordpress.org.\n\n**Do I need the Go theme to use CoBlocks?**\n\nNo. GoDaddy recommends its Go theme as a companion, but the plugin works with themes that support the block editor.\n\n**Are CoBlocks form submissions saved?**\n\nNo. The Form block emails each submission to the address you choose, without keeping a copy in WordPress. If you need a record of submissions, pick a form plugin that stores them.\n\n**What happens to my pages if I deactivate CoBlocks?**\n\nThe `coblocks/*` blocks stay in your content, but the editor no longer recognizes them and they no longer display as intended. Before switching tools, list the affected pages and plan to rebuild them.\n\n## Key facts\n\n- Category: Builders and themes\n- Vendor: GoDaddy\n- Price: Free, with no paid edition\n- Active installations (wordpress.org): 300 000+\n- Version: 3.1.17\n- Official page: https://wordpress.org/plugins/coblocks/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs\n- Still visible: CSS classes",
    "catalog": "coblocks",
    "essentials": [
        "Best for maintaining a site already built with its blocks, or adding galleries and a menu for free.",
        "Main caveat: slow development, Google-hosted fonts and a form that stores nothing.",
        "Free, with no paid edition: every block and setting is included."
    ],
    "format": "application/json"
}