{
    "title": "OceanWP",
    "seo_title": "OceanWP: review, recommended settings and limits",
    "h1": "OceanWP",
    "description": "OceanWP theme and Ocean Extra: strengths, limitations, premium extensions, recommended settings (performance, local fonts) and patched vulnerabilities.",
    "lead": "OceanWP, one of the most installed WordPress themes, packs detailed Customizer settings for your blog, header and WooCommerce store, backed by the Ocean Extra plugin. Our take on the theme and its extensions, the performance settings to turn on and the vulnerabilities worth knowing.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/oceanwp/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/oceanwp/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/oceanwp/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/oceanwp/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:18:09+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "OceanWP",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/oceanwp/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/oceanwp/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/oceanwp/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "OceanWP",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/oceanwp/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/oceanwp/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/oceanwp/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "OceanWP",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/oceanwp/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/oceanwp/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/oceanwp/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "OceanWP",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/oceanwp/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/oceanwp/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/oceanwp/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "OceanWP",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/oceanwp/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/oceanwp/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/oceanwp/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "OceanWP",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/oceanwp/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/oceanwp/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/oceanwp/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "OceanWP",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/oceanwp/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/oceanwp/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/oceanwp/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "OceanWP"
        },
        {
            "level": 2,
            "text": "What OceanWP does on your site"
        },
        {
            "level": 2,
            "text": "Which sites OceanWP suits best"
        },
        {
            "level": 2,
            "text": "OceanWP strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The OceanWP settings we recommend"
        },
        {
            "level": 2,
            "text": "OceanWP security: a quiet theme, a plugin to watch"
        },
        {
            "level": 2,
            "text": "OceanWP FAQ",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for WooCommerce stores and Elementor sites that want plenty of free visual settings.\n- Main caveat: many features rely on Ocean Extra, a plugin with more security issues than the theme.\n- Free; sticky header and hooks need the Core Extensions Bundle, from $52 a year for one site.\n\n## What OceanWP does on your site\n\nOceanWP is a classic, multipurpose theme: it handles your layout, header, top bar, blog, sidebars, footer and a rich set of WooCommerce templates (a quick view button, off-canvas filters, add to cart without a page reload). Almost everything is set in Appearance > Customize, where the theme adds its own panels, including Typography, SEO Settings, Accessibility - A11Y and Performance. It works with the block editor and with page builders such as Elementor.\n\nMany features come from a free companion plugin, Ocean Extra, which the theme offers to install. It adds per-page and per-post settings (header, page title, footer, sidebar), a template library for custom headers and footers, demo site import, widgets, a mega menu, menu icons, shortcodes, local hosting of Google Fonts and the OceanWP Panel. Ocean Extra only works with this theme.\n\nThe vendor, OceanWP LLC, sells its premium plugins as a package, the Core Extensions Bundle: the official documentation lists 14 premium extensions, more than 240 Pro demos and ticket support. They include the sticky header, hooks, white labeling and Elementor widgets; other official plugins, such as Ocean Social Sharing and Ocean Modal Window, are free on wordpress.org.\n\n![Diagram: OceanWP works on visitors and bots, wordpress, database and files. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/oceanwp/diagram-en.svg?v=a60916aa)\n\n## Which sites OceanWP suits best\n\nOceanWP makes sense when you want lots of visual settings without writing code:\n\n- **WooCommerce stores**: quick view, a floating add to cart bar on product pages and off-canvas filters all ship with the free theme.\n- **Sites built with Elementor**: each page can hide the header, title or footer through the Ocean Extra settings.\n- **Freelancers who start from a demo**: Ocean Extra imports a complete site that you then adjust in the Customizer.\n- **Sites that must work with a keyboard**: the theme carries the wordpress.org “accessibility-ready” tag and has a dedicated accessibility mode.\n\nIt is not the best pick if you want to build your header and templates in the WordPress Site Editor: OceanWP is not a block theme. It is not the leanest option either. If you want a theme that stands on its own, with no companion plugin to watch, compare it with [GeneratePress](https://www.wp-masquerade.com/features/camouflaged-plugins/generatepress/) or [Astra](https://www.wp-masquerade.com/features/camouflaged-plugins/astra/).\n\n## OceanWP strengths and limitations\n\n### Strengths\n\n- **A very complete free theme.** Blog, headers, sidebars and WooCommerce can be fine-tuned without paying.\n- **A Performance panel.** It turns off emoji styles, icon libraries, the image lightbox and other scripts your site may not need.\n- **An accessibility mode.** Since version 4.2.0 (June 2026), it improves the markup of the header, menus and search forms.\n- **Documented fixes.** The changelog credits every security report with its date, and the fix usually ships before the public disclosure.\n\n### Limitations\n\n- **Two pieces to maintain.** Local fonts, per-page settings, demos and the mega menu rely on Ocean Extra, a plugin with its own updates.\n- **A more exposed companion plugin.** Ocean Extra has far more published vulnerabilities than the theme, including two that need no account.\n- **Sticky header and hooks cost extra.** Like white labeling, they require the Core Extensions Bundle.\n- **Not a block theme.** The WordPress Site Editor controls neither the header nor the templates; everything goes through the Customizer.\n\n## The OceanWP settings we recommend\n\nAll of these settings exist in the current free version. Local fonts and the OceanWP Panel need Ocean Extra; the rest live in the theme alone.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Auto-updates**  Appearance > Themes > OceanWP (theme details), and Plugins for Ocean Extra | On for both | The theme and the plugin get their security fixes separately. |\n| **Enable Local Google Fonts**  Appearance > Customize > Typography > Google Font Settings | On if you use a Google font | Fonts are served from your server instead of Google; the option appears once “Enable Google Fonts” is on. |\n| **Emoji**  Appearance > Customize > Performance | Disabled | Removes the WordPress emoji script and styles; browsers still display emoji natively. |\n| **Font Awesome Icons** and **Simple Line Icons**  Same screen | Disabled if your menus and widgets don’t use them | One less stylesheet per page; then check the icons in your header and footer. |\n| **Styling Options Location**  Same screen | Custom File | Your custom CSS goes into a file in the uploads folder, which browsers can cache. |\n| **Enable Schema Markup**  Appearance > Customize > SEO Settings | Off if your SEO plugin outputs structured data | Avoids two competing descriptions of the same page; it is on by default. |\n| **Enable OpenGraph**  Same screen | Off (default) if an SEO plugin handles sharing | Two sets of Open Graph tags contradict each other on social networks. |\n| **Enable Accessibility Mode**  Appearance > Customize > Accessibility - A11Y | On, then check the header | It is on by default for new installs, but not for sites set up before version 4.2.0. |\n| **SVG Support**  OceanWP > OceanWP Panel > Integration | Off (default) | An SVG file can contain code; only allow uploads if you actually need them. |\n\n- After turning on local fonts, view the source of a page: no `fonts.googleapis.com` address should appear.\n- After any change under Performance, browse the home page, a post and, if you have one, a product page: icons, menus and galleries should display normally.\n- Under Plugins, make sure Ocean Extra is at version 2.6.1 or later.\n- If you have moved away from OceanWP, delete Ocean Extra: it does nothing without the theme.\n\n## OceanWP security: a quiet theme, a plugin to watch\n\nThe theme has few published vulnerabilities and only one rated high. Ocean Extra, installed on most OceanWP sites, has more, mostly stored [XSS vulnerabilities](https://www.wp-masquerade.com/glossary/xss/) through its shortcodes and widgets. The cases worth knowing:\n\n- **CVE-2023-23700, theme, fixed in 3.4.2**: local file inclusion with a plain subscriber account (CVSS 7.6).\n- **CVE-2025-8891, theme, fixed in 4.1.2**: an administrator clicking a crafted link could have Ocean Extra installed without knowing it (CVSS 4.3).\n- **CVE-2025-3472, Ocean Extra, fixed in 2.4.7**: on a site running WooCommerce, a visitor with no account could execute shortcodes (CVSS 6.5).\n- **CVE-2026-86803, Ocean Extra, fixed in 2.6.1**: another unauthenticated shortcode execution, this time through the template library shortcode (CVSS 6.5).\n\nTheme version 4.2.8 (October 2026) patches yet another issue reported by Patchstack. So turn on auto-updates for both the theme and Ocean Extra (see our guide to plugin auto-updates); the full timeline is in our article on [OceanWP’s vulnerability history](https://www.wp-masquerade.com/oceanwp-theme-security-vulnerabilities/). WP Masquerade Pro renames the theme folder and the `oceanwp` and `oe` handles of scripts and stylesheets, while the `oceanwpLocalize` variable and the `oceanwp-*` classes stay visible: this makes the theme harder for bots to spot, but it is no substitute for updating.\n\n## OceanWP FAQ\n\n**Do I need Ocean Extra with OceanWP?**\n\nNo, the theme works on its own. Ocean Extra becomes useful if you want per-page settings, demos, local fonts or the template library; in that case, keep it as up to date as the theme.\n\n**Is there a paid version of Ocean Extra?**\n\nNo: according to its wordpress.org page, Ocean Extra is entirely free. Premium features are separate plugins from the Core Extensions Bundle, which you then configure from the OceanWP Panel in Ocean Extra.\n\n**Can I use OceanWP Pro extensions on client sites?**\n\nYes, the official documentation allows it but forbids reselling licenses.\n\n**Do the free demos require a license?**\n\nNo, Ocean Extra imports the free demos without a license. Parts built with premium extensions won’t display, but the demos only rely on free versions of third-party plugins, such as [Elementor](https://www.wp-masquerade.com/features/camouflaged-plugins/elementor/).\n\n**How much does the Core Extensions Bundle cost?**\n\nAt full price, the official page lists $52 per year for one site and $105 per year for 10 sites, or $195 and $390 for lifetime plans. Prices exclude VAT, and refunds are available within 14 days.\n\n## Key facts\n\n- Category: Builders and themes\n- Vendor: OceanWP LLC\n- Price: Free; Core Extensions Bundle from $52 per year for one site, excl. VAT\n- Active installations (wordpress.org): 400 000+\n- Version: 4.2.8\n- Official page: https://wordpress.org/themes/oceanwp/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes",
    "catalog": "oceanwp",
    "essentials": [
        "Best for WooCommerce stores and Elementor sites that want plenty of free visual settings.",
        "Main caveat: many features rely on Ocean Extra, a plugin with more security issues than the theme.",
        "Free; sticky header and hooks need the Core Extensions Bundle, from $52 a year for one site."
    ],
    "format": "application/json"
}