--- title: "Loco Translate" description: "Loco Translate: strengths, limitations, machine translation, where to save files, recommended access settings and the vulnerabilities patched in 2026." language: "en" locale: "en-US" type: "plugin-sheet" canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/loco-translate/" published: "2026-11-04T08:00:00+00:00" modified: "2026-11-05T21:14:23+00:00" translations: en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/loco-translate/index.md" fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/loco-translate/index.md" es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/loco-translate/index.md" de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/loco-translate/index.md" it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/loco-translate/index.md" pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/loco-translate/index.md" nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/loco-translate/index.md" --- # Loco Translate Loco Translate lets you fix and complete the translations of your themes, plugins and WordPress core from the dashboard, with optional machine translation. Our take, the file location to pick so updates don’t wipe your work, the access settings to tighten and the patched vulnerabilities. ## The essentials - Best for fixing a theme’s or plugin’s interface text without ever leaving WordPress. - Main caveat: it doesn’t translate pages or posts, and must stay active to load your files. - Free, with no paid version; only the machine translation services charge you. ## What Loco Translate does in your WordPress admin Loco Translate edits the translation files of your themes, your plugins and WordPress itself, right from the dashboard. You pick a plugin under Loco Translate > Plugins, open one of its languages (or add a new one), and an editor lists every interface string in English next to its translation. When you save, the plugin writes the PO file and compiles the MO and JSON files WordPress actually loads, with no desktop app like Poedit and no gettext tools on the server. For developers, it extracts translatable strings from source code, builds the POT template and syncs PO files when a plugin adds new text. It keeps backups of PO files, with diff and restore. The editor’s Auto button and its “Suggest translation” feature call machine translation services: DeepL, Google Translate, Lecto AI, Microsoft Translator and OpenAI, using your own API keys. Loco Translate is the official WordPress plugin of Loco, Tim Whitlock’s translation management service. It is completely free and needs no Loco account; the machine translation providers bill you at their own rates. It requires the PHP `mbstring` and `json` extensions. ![Diagram: Loco Translate works on visitors and bots, wordpress, database and files. Public traces: no known public trace.](https://www.wp-masquerade.com/media/wpm-sheets/loco/diagram-en.svg?v=72b3096f) ## Which sites Loco Translate suits Loco Translate solves one specific problem: fixing or completing the interface text your themes and plugins display. - **Sites with incomplete or clumsy translations**: a button left in English, a badly translated form label, wording that doesn’t match your brand voice. - **Custom themes and plugins**: a developer creates the POT template and language files without leaving WordPress. - **Agencies and translators**: a client or a translator gets access to Loco Translate without becoming a site administrator. - **Plugins with no translation in your language**: machine translation produces a first draft that you then review. It is the wrong tool for a multilingual site: Loco Translate doesn’t translate your pages or posts and creates no per-language versions. For that you need a plugin like [Polylang](https://www.wp-masquerade.com/features/camouflaged-plugins/polylang/), which can happily run alongside Loco Translate for interface strings. ## Loco Translate strengths and limitations ### Strengths - **Everything happens inside WordPress.** Editing, MO and JSON compiling, POT creation and syncing, with no extra software or FTP access. - **A folder that survives updates.** The Custom location, `wp-content/languages/loco/`, is never changed or deleted when WordPress updates a plugin. - **Five machine translation providers.** DeepL, Google, Lecto AI, Microsoft and OpenAI, with no fee added by Loco. - **Completely free.** No paid version, no account to create, no locked features. ### Limitations - **It has to stay active.** Translations saved in the Custom location stop loading once you deactivate the plugin. - **API keys stored in plain text.** They sit in the database and anyone with access to Loco Translate can use them. - **Machine translations need review.** Source text is assumed to be English, and HTML or placeholders like `%s` can get mangled. - **Technical vocabulary.** PO, POT, MO, sync: the interface assumes you know a little about how gettext works. - **Several vulnerabilities fixed in 2026.** Including a request forgery leading to code execution, so fast updates matter. ## The Loco Translate settings we recommend Most defaults are cautious: what matters is picking the right location for your files and limiting who can translate. Global settings live under Loco Translate > Settings. | Setting | Recommended value | Why | | --- | --- | --- | | **Choose a location** Loco Translate > Plugins (or Themes) > name > New language | Custom | The Author and System locations can be overwritten by plugin or translation updates. | | **Grant access to roles** Loco Translate > Settings > Plugin settings | Administrators and trusted accounts only | A role with access to Loco Translate can write files on the server; roles marked † have low privileges and shouldn’t get it. | | **Number of backups to keep of each file** Same screen | 5 (the default), never 0 | Zero turns backups off and leaves you nothing to restore after a mistake. | | **Modification of installed files** Same screen | Allow (with warning), the default | The warning reminds you that a file saved inside a plugin’s folder will vanish at its next update. | | **Editing of POT (template) files** Same screen | Allow (with warning), the default | A translation typed into a POT template by mistake breaks it for every other language. | | **Viewing of referenced source code** Same screen | Admins only (the default) | Translators don’t need to read your site’s PHP code. | | **Save credentials in session** Same screen | Off (the default) | Loco’s documentation advises against it: your FTP or SSH credentials would stay stored for the session. | | **API keys** Loco Translate > Settings > API keys | A dedicated key with a spending cap at the provider | Every Loco Translate user can burn through your quota; a cap limits the bill. | - After your first save, check that `wp-content/languages/loco/plugins/` contains the PO and MO files of the plugin you translated. - Open the page in a private window: the new translation should show up (purge your page cache if you use one). - Under Users, review who has the Translator role or any role you granted access to. - Back up `wp-content/languages/loco/` with the rest of the site: Loco can’t guarantee the files survive a server problem. ## Loco Translate security: recent flaws, patched in 2.8.x Loco Translate writes files on the server, which makes its vulnerabilities more serious than those of a plugin that only displays content. Several were published for the 2.8 branch: - **CVE-2026-15005, fixed in 2.8.6**: a [cross-site request forgery](https://www.wp-masquerade.com/glossary/csrf/) could run PHP code on the server if a logged-in user followed a crafted link (CVSS 8.8). - **CVE-2026-15066, fixed in 2.8.8**: [stored XSS](https://www.wp-masquerade.com/glossary/xss/) through PO file comments, requiring translator access or higher (CVSS 6.4). - **CVE-2026-4146, fixed in 2.8.3**: reflected XSS via the `update_href` parameter, exploitable without an account by tricking a logged-in user (CVSS 6.1). - **CVE-2026-1921, versions up to 2.8.2**: translator access was enough to read some files outside the intended folder (CVSS 4.9). - **CVE-2021-24721, fixed in 2.5.4**: a translator could inject PHP code into a file saved with a `.php` extension. Two habits matter: turn on automatic updates for Loco Translate (see our guide to automatic plugin updates) and keep access to trusted accounts, since several flaws require translator access. Since version 2.8.6, the Translator role is only created when you explicitly grant access. Loco Translate works only in the admin area and adds nothing to your public pages, so WP Masquerade’s camouflage matters little here: updating is the real protection. ## Loco Translate FAQ **Will my translations disappear with the next update?** Not if you save them in the Custom location (`wp-content/languages/loco/`), which updates don’t touch. Files saved inside the plugin or theme folder, on the other hand, are replaced at every update. **Can I deactivate Loco Translate once my translations are done?** Not if your files are in the Custom location: Loco’s documentation states the plugin must stay installed and active for WordPress to load them. **Is machine translation free?** Loco charges nothing for access to these services, but each provider applies its own pricing and quotas. The editor shows the character count before sending, which helps you estimate the cost. **Can Loco Translate translate my pages and posts?** No. It translates the interface strings of themes, plugins and WordPress. For a site in several languages, use a multilingual plugin like Polylang or [TranslatePress](https://www.wp-masquerade.com/features/camouflaged-plugins/translatepress/). ## Key facts - Category: Languages and translation - Vendor: Loco (Tim Whitlock) - Price: Free, with no paid version; machine translation is billed by the provider you choose - Active installations (wordpress.org): 1 000 000+ - Version: 2.8.9 - Official page: https://wordpress.org/plugins/loco-translate/ ## What WP Masquerade hides - Handled by the free version of WP Masquerade