---
title: "Custom Post Type UI"
description: "Custom Post Type UI: strengths, limitations, CPT UI Pro pricing, recommended settings (archives, REST API, export) and patched flaws, to decide well."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/custom-post-type-ui/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T21:04:14+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/custom-post-type-ui/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/custom-post-type-ui/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/custom-post-type-ui/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/custom-post-type-ui/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/custom-post-type-ui/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/custom-post-type-ui/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/custom-post-type-ui/index.md"
---

# Custom Post Type UI

Custom Post Type UI registers custom post types and taxonomies from the WordPress dashboard, with no code. Our take on what it does and doesn’t do, the settings to decide before you publish, how to leave it without losing content, and the patched vulnerabilities.

## The essentials

- Best for portfolios, catalogs or directories that need their own content types.
- Main caveat: no fields or display, and the types disappear if you deactivate it.
- Free; CPT UI Pro costs $99 and adds display blocks, admin columns and multisite tools.

## What Custom Post Type UI does on your site

Custom Post Type UI (CPT UI) registers custom post types and taxonomies from the WordPress dashboard, with no code: a “Projects” type for a portfolio, “Events” for a calendar, a “Locations” taxonomy to sort them. You fill in a form (slug, plural and singular labels, options), and on every page load the plugin calls WordPress’s own `register_post_type()` and `register_taxonomy()` functions with those values. The settings live in two database options, `cptui_post_types` and `cptui_taxonomies`.

The form exposes almost every WordPress argument: around thirty labels, public visibility, archives, URL rewrites, the REST API and supported features (title, editor, featured image, excerpt, revisions and more). The Tools menu exports and imports these settings as JSON, also from the command line with `wp cptui export` and `wp cptui import`, and the “Get code” tab outputs the equivalent PHP. The plugin loads its scripts and styles in the dashboard only, so nothing is added to your public pages.

CPT UI is built by the agency WebDevStudios and distributed for free on wordpress.org. It handles registration only: no custom fields, no layouts. CPT UI Pro, sold separately on Pluginize, adds a display block with ten layouts, taxonomy filter blocks, a column and filter builder for admin list tables, and multisite network management.

![Diagram: Custom Post Type UI works on visitors and bots, wordpress, database and files. Public traces: no known public trace.](https://www.wp-masquerade.com/media/wpm-sheets/cpt-ui/diagram-en.svg?v=b986df71)

## Which sites Custom Post Type UI is a good fit for

CPT UI makes sense when you need to structure content that is neither a post nor a page:

- **Portfolios, catalogs, staff directories**: each type gets its own dashboard menu, its own URLs and, if you want one, its own archive page.
- **Custom themes paired with a fields plugin**: CPT UI declares the type, the fields plugin adds the data (price, date, location), and the theme displays it.
- **Agencies that reuse one structure across many sites**: a JSON or WP-CLI export copies the types and taxonomies from one site to another in a single step.

It is not the best pick if you already run [Advanced Custom Fields](https://www.wp-masquerade.com/features/camouflaged-plugins/advanced-custom-fields/): its free version registers post types and taxonomies too, which saves you a plugin. Nor is it a complete solution if you expect fields and ready-made display: CPT UI only declares the types.

## Custom Post Type UI strengths and limitations

### Strengths

- **Full registration for free.** Labels, archives, rewrites, the REST API and supported features can all be set without paying.
- **No lock-in.** The “Get code” tab gives you the PHP to drop into your theme the day you want to stop using the plugin.
- **Import, export and WP-CLI.** Settings move between sites as JSON, by hand or in a script.
- **No files on public pages.** Scripts and styles load in the dashboard only.

### Limitations

- **Registration only.** No custom fields and no display: you need another plugin, your theme or CPT UI Pro.
- **A permanent dependency.** Deactivate the plugin and your types vanish from the dashboard and the site until code registers them again.
- **Settings stored in the database.** Unlike ACF’s Local JSON, they can’t be versioned with git: you have to export them by hand.
- **Slug changes are risky.** Renaming a slug registers a new type, and existing content follows only if you tick the migration checkbox.

## The settings we recommend for your content types

You’ll find these on the CPT UI > Add/edit post types screen (or Add/edit taxonomies), in the “Basic settings” and “Settings” panels. Decide on them before you publish your first entries, because some of them change URLs.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Post Type Slug**  CPT UI > Add/edit post types > Basic settings | Short, singular, final (20 characters max) | Changing it registers a new type: existing entries follow only if you tick “Migrate posts to newly renamed post type?”. |
| **Show in REST API**  Same screen, Settings panel | True (default) | The block editor runs on the REST API: set to False, the type opens in the classic editor. |
| **Has Archive**  Same panel | True if you want a page listing every entry of the type | False by default: no archive URL exists, which often surprises people after building a portfolio. |
| **Exclude From Search**  Same panel | False (default), True for purely internal content | Set to True, entries also drop out of taxonomy term archives, not just search results. |
| **Delete with user**  Same panel | False (default) | Set to True, deleting an account also deletes that user’s entries of this type. |
| **Can Export**  Same panel | True | CPT UI defaults to False, so the WordPress Tools > Export screen leaves these entries out. |
| **Show Admin Column**  CPT UI > Add/edit taxonomies > Settings | True | Shows the taxonomy’s terms in the content list, handy for checking how entries are sorted. |

- Open the URL of an entry of the new type: if it returns a 404 error, save Settings > Permalinks again without changing anything.
- Export the settings under CPT UI > Tools, Post types and Taxonomies tabs, and keep the JSON with your backups.
- Before any deactivation, copy the code from the “Get code” tab into your theme or a code snippets plugin.
- Create a draft of the new type in the block editor to confirm the REST API responds.

## Custom Post Type UI security: access flaws patched in late 2025

The vulnerabilities published for CPT UI are medium severity and mostly involve its admin screens:

- **CVE-2025-12826, fixed in 1.18.1**: a capability check was missing when processing post types; in limited situations, a subscriber account could add, edit or delete types (CVSS 4.8).
- **CVE-2025-14056, fixed in 1.18.2**: stored XSS through the label of an imported type, triggered when the “Get code” tab was opened; it required an administrator account (CVSS 4.4).
- **CVE-2023-1623, fixed in 1.13.5**: without CSRF protection, a booby-trapped link could make a logged-in admin send the site’s debug information to an email address chosen by the attacker.

Turn on automatic plugin updates for CPT UI and keep the administrator role for the people who actually need it (see our article on WordPress roles and capabilities). The plugin adds nothing to your public pages; the box below shows what WP Masquerade covers for it.

## Custom Post Type UI frequently asked questions

**What happens to my content if I deactivate CPT UI?**

It stays in the database, but WordPress no longer knows its type: the entries disappear from the dashboard and their URLs return a 404 error. To move away from the plugin, first paste the code from the “Get code” tab into your theme or into a plugin such as [WPCode](https://www.wp-masquerade.com/features/camouflaged-plugins/wpcode/).

**How do I display a content type created with CPT UI?**

Through your theme: `single-{slug}.php` and `archive-{slug}.php` templates in a classic theme, or Site Editor templates in a block theme. The WordPress Query Loop block can list these entries too, and CPT UI Pro adds its own display blocks.

**Does CPT UI add custom fields?**

No. It declares the type and its supported features, including the WordPress “Custom Fields” box, but it doesn’t create structured fields. Pair it with a fields plugin such as ACF or Meta Box.

**How much is CPT UI Pro, and do I keep the free plugin?**

The official page lists $99, with six months of updates and support and a 30-day money-back guarantee. CPT UI Pro doesn’t require the free plugin, but it picks up the types the free plugin already registered.

## Key facts

- Category: Utilities
- Vendor: WebDevStudios
- Price: Free; CPT UI Pro costs $99, with six months of updates and support
- Active installations (wordpress.org): 1 000 000+
- Version: 1.19.3
- Official page: https://wordpress.org/plugins/custom-post-type-ui/

## What WP Masquerade hides

- Handled by the free version of WP Masquerade