What Elementor does on your site
Elementor swaps the standard page editing screen for a visual drag-and-drop editor: you drop in containers, then widgets (heading, image, button, gallery, carousel, tabs, HTML code…) and adjust spacing, typography and colors while you see the result. On top of that you get custom breakpoints for tablet and phone, revision history, a template library and, since version 4, global styles (variables and classes).
Unlike the block editor, Elementor stores the layout in post metadata and leaves only a simplified version in the post content. On the front end it loads its own stylesheets and scripts, and adds a meta name="generator" tag to the page head that gives away its version.
The developer, Elementor Ltd., is an Israeli company based in Ramat Gan. The free plugin includes more than 40 widgets according to the developer. Elementor Pro, a separate plugin installed on top of it, adds the Theme Builder (headers, footers, archives), forms, popups, the WooCommerce Builder, dynamic content and custom code.
Which sites Elementor is a good fit for
Elementor makes sense when visual design matters more than lean code:
- Business sites and landing pages: someone with no coding skills can build polished pages, section by section, and tune them for mobile.
- Freelancers and agencies building sites for clients: templates, global styles and the Role Manager help keep a consistent brand.
- Sites that want to customize everything: with Pro, headers, footers, post templates and shop pages are all built in the same editor.
It’s not the best pick for a mostly text-based blog or a site where every millisecond counts: the WordPress block editor is often enough, and your pages don’t depend on a plugin to render. If you want to stay with Elementor on a lightweight theme built for it, look at Hello Elementor; if you’re weighing another builder, compare it with Divi.
Elementor strengths and limitations
Strengths
- A full visual editor for free. Containers, basic widgets, custom breakpoints, revisions and templates need no license.
- Built-in performance settings. Images, background images, fonts and element caching are handled in a single tab, with no extra plugin.
- A free Role Manager. You can block the editor for some roles and keep JSON uploads and the HTML widget for the people who need them.
- A huge ecosystem. The Hello Elementor theme, add-ons and tutorials are everywhere, so another developer can take over the site easily.
Limitations
- Key features are in Pro. Theme Builder, forms, popups, WooCommerce and custom CSS all require a license.
- Hard to move away from. The layout lives in Elementor’s metadata: deactivate the plugin and only a simplified, unstyled version of the content remains.
- More demanding on hosting. Elementor requires at least 256 MB of PHP memory and recommends 512 MB, more with WooCommerce.
- A frequent target. Dozens of vulnerabilities have been published since 2020, mostly XSS bugs that need a Contributor account, because the editor is open to that role.
- The entry Pro plan is limited. The Essential plan doesn’t store form submissions and includes neither popups nor eCommerce features.
The Elementor settings we recommend
All of these settings exist in the current free version, under Elementor > Settings (General, Advanced and Performance tabs) and Elementor > Role Manager. Save, clear your page cache, then run the checks below.
| Setting | Recommended value | Why |
|---|---|---|
| Enable Unfiltered File Uploads Elementor > Settings > Advanced | Disable (default) | Elementor itself warns that allowing any file type, SVG and JSON included, is a security risk. |
| No access to editor Elementor > Role Manager, for each role | Checked for roles that don’t build pages (Contributor, for example) | Most Elementor vulnerabilities require an account that can open the editor. |
| Enable the option to upload JSON files and Enable the option to use the HTML widget Same screen, inside each role | Unchecked unless truly needed | Elementor warns that both permissions can be abused to run malicious scripts. |
| Generator Tag Elementor > Settings > Advanced | Disable | The tag shows the Elementor version and its active features, with no value for your visitors. |
| Post Types Elementor > Settings > General | Only the types you build with Elementor (pages and posts by default) | Keeps the editor off content that doesn’t need it. |
| CSS Print Method Elementor > Settings > Performance | External File (default) | Styles are cached by the browser instead of weighing down every page. |
| Optimized Image Loading and Lazy Load Background Images Same tab | Enable (defaults) | Speeds up the first image and delays images further down the page. |
| Load Google Fonts Locally Same tab | Enable if you use Google Fonts | Fonts come from your own server, so visitors no longer contact Google’s servers, which helps with GDPR. |
- View the source of a page built with Elementor: the
meta name="generator"tag starting with "Elementor" should be gone. - Log in with a test Contributor account: the "Edit with Elementor" button should no longer appear if you blocked that role.
- With Elementor Pro, make sure the license is activated on the site: without it, Pro gets no updates.
Elementor security: file upload flaws to watch
Because the editor is open to writing roles, most Elementor vulnerabilities require a Contributor account (see roles and least privilege). The most serious ones involve file uploads and admin actions:
- CVE-2022-1329, fixed in 3.6.3: in versions 3.6.0 to 3.6.2, the onboarding module let a mere Subscriber upload a malicious file and run code (CVSS 8.8).
- CVE-2023-48777, fixed in 3.18.2: template import in versions 3.3.0 to 3.18.1 let a Contributor upload a dangerous file (CVSS 9.9).
- CVE-2026-62062, fixed in 4.3.2: a cross-site request forgery (CSRF) made a logged-in administrator who opened a booby-trapped link run REST API actions (CVSS 8.8).
- CVE-2026-32475, Elementor Pro, fixed in 4.2.2: unauthenticated file upload through a form with a file field (CVSS 9.0), exploited from the day the fix shipped.
Elementor and Elementor Pro update separately, so turn on automatic updates for both (see our guide to plugin auto-updates). The full timeline is in our article on Elementor security vulnerabilities. Elementor’s generator tag announces its version (see HTML comments and the generator tag): the free version of WP Masquerade removes it, which makes the site harder for bots hunting these flaws to spot, without replacing updates.
What WP Masquerade hides for Elementor
Free version Handled by the free version of WP Masquerade
Elementor is one of the 50 most used plugins known to the free version. Pro goes further by renaming its files.
Free version
- generator tag
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- tag IDs
elementor-frontend-css - JavaScript variables
elementorFrontendConfig, elementorFrontend - CSS classes
elementor-*, e-con - cookies
elementor_pro_login (Elementor Pro login form)
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Elementor frequently asked questions
Is the free version of Elementor enough?
For building pages, yes: the editor, basic widgets, responsive controls and performance settings are free. You need Pro to design the header, footer and post templates, or to create forms and popups.
Do I keep the free Elementor plugin when I install Elementor Pro?
Yes. Elementor Pro is an add-on that runs on top of the free plugin: both stay active, and each one needs to be kept up to date.
What happens to my pages if I deactivate Elementor?
Their layout disappears: Elementor leaves only a simplified version in the content (headings, text, images), with no columns or styling. Plan a page-by-page rebuild before switching tools.
How much does Elementor Pro cost?
The official pricing page lists the Essential plan at $60 per year for one site, plus applicable taxes. The Advanced Solo plan, at $84 per year for one site, adds stored form submissions, popups and eCommerce features; the 3-site and 25-site plans cost $108 and $204 per year.