What Oxygen does on your site
Oxygen is a visual site builder plugin for WordPress, made by Soflyy. You build pages from elements that map closely to HTML (containers, text, links, images, content loops) and style them with selectors, classes and CSS variables. The same editor handles your site templates: headers, footers, and single, archive, search and 404 templates, with display conditions and dynamic data (WordPress fields, Advanced Custom Fields, Meta Box).
The current version, Oxygen 6, shares most of its engine with Breakdance, Soflyy’s other builder; the older 4.x branch is now called Oxygen Classic and keeps its own website. Since version 6.2, an MCP-compatible AI agent (Claude, Codex, Cursor, Gemini CLI...) can create and edit pages, templates, components and settings through the free Agent Connector plugin, which you install from Oxygen’s settings. Soflyy doesn’t resell AI credits: you use your own agent’s plan.
Oxygen isn’t distributed on wordpress.org: you download the zip from the vendor’s site and install it under Plugins > Add Plugin > Upload Plugin. It works fully without a license, but then shows a “Built with Oxygen” badge in the bottom-right corner of every page, visible to all visitors. The license, sold as a one-time payment, removes that badge.
Which sites Oxygen is a good fit for
Oxygen is aimed at developers and site builders who want control over the code it outputs rather than a library of ready-made modules:
- Freelancers and agencies comfortable with HTML and CSS: selectors, states, variables and breakpoints are set property by property, and one license covers every site, client sites included.
- Sites built on structured content: directories, catalogs or listings sites built with custom post types, ACF or Meta Box fields and query loops.
- Teams that build with an AI agent: the agent produces native Oxygen elements that you can then refine by hand in the visual editor.
It’s the wrong pick for a client who wants to change layouts on their own without any CSS knowledge, or for a site that needs to switch tools without rebuilding everything. If you’re weighing options, compare it with Breakdance, from the same vendor, or Bricks, and read our WordPress builder comparison.
Oxygen strengths and limitations
Strengths
- Pay once, unlimited sites. The lifetime license includes updates and support with no renewals, and comes with a 60-day refund window.
- A full trial at no cost. Without a license key every feature stays available; only the “Built with Oxygen” badge marks the unlicensed install.
- Fine-grained CSS control. Selectors, CSS variables, reusable components, interactions and animations are all managed in the editor, with no imposed modules.
- Built-in WordPress cleanup. The Performance tab removes, one option at a time, emoji scripts, Dashicons for visitors, RSD and WLW links, the generator tag and XML-RPC pingbacks.
Limitations
- Pages tied to Oxygen. Layouts are stored in Oxygen’s own data (the
_oxygen_datapost meta), not in post content: leaving Oxygen means rebuilding your pages. - You need to know CSS. The editor exposes CSS properties one by one; a beginner or a client will move more slowly than with a module-based builder.
- Access for trusted people only. Soflyy warns that anyone with access to Oxygen can run arbitrary PHP through the code element.
- Elements split across add-ons. Forms, more than 130 Breakdance elements and advanced WooCommerce tools come as separate Soflyy extensions.
- A server to size properly. Soflyy recommends at least 512 MB of PHP memory and around 90 seconds of execution time for large saves.
The settings we recommend for Oxygen
All of these settings live under Oxygen > Settings and are saved with the “Save Changes” button.
| Setting | Recommended value | Why |
|---|---|---|
| “License Key” Oxygen > Settings > License | Filled in on live sites | Removes the “Built with Oxygen” badge shown to visitors and the “Get Pro” page from the menu. |
| “Allow unfiltered HTML in all dynamic data output” Oxygen > Settings > Advanced | Off (default) | Otherwise an author without the unfiltered_html capability can inject HTML and scripts into your pages. |
| “Allow SVG Uploads In The WP Media Library” Oxygen > Settings > Advanced | Off | An SVG file can contain code; use a plugin that sanitizes it instead, such as Safe SVG. |
| “Apply the_content filter to Oxygen content” Oxygen > Settings > Advanced | Off, unless a plugin depends on it | When on, it runs shortcodes that a visitor could slip into data displayed by Oxygen. |
| “Limit Revisions” and “Max Revisions” Oxygen > Settings > Advanced | On, 15 revisions | Keeps each page’s stored revisions from growing forever in the database. |
| “WP Generator”, “WP Emoji”, “RSD Links”, “WLW Link” Oxygen > Settings > Performance | On | Strips unneeded code, including the tag that advertises your WordPress version. |
| “XML-RPC Pingbacks” Oxygen > Settings > Performance | On if no app relies on XML-RPC | Stops pingback spam but also disables authenticated XML-RPC requests: test your publishing tools. |
| “Allow agents to access this site over MCP” Oxygen > Settings > Agents & MCP | Unchecked if you don’t use an AI agent | Checked by default, it makes Oxygen’s editing tools available to connected agents. |
- Open the site in a private browsing window: the “Built with Oxygen” badge should no longer appear in the bottom-right corner.
- Under Oxygen > Settings > Tools, click “Create Directories”: no failing path should be listed for
wp-content/uploads/oxygen/. - After a domain change, back up the database, then run “Replace URL” in the same tab, in addition to a general search-and-replace tool.
- Check that only trusted administrators can open the Oxygen editor.
Oxygen security: few published flaws, a powerful editor
Vulnerability databases list only a few flaws for Oxygen. The two worth knowing:
- CVE-2022-46841, fixed in 4.4: a CSRF flaw in Oxygen Builder that could trick a logged-in user into performing actions without knowing it.
- Versions 6.0 to 6.1.1, fixed in 6.1.2: a missing capability check on a function let an unauthenticated visitor trigger an unauthorized action (reported by WPScan and Wordfence).
The bigger risk comes from the tool’s power: the code element runs PHP, and an MCP connection left on gives an agent the same editing tools. Keep Oxygen updated from Dashboard > Updates, restrict access to the editor and uncheck MCP access when you don’t need it. WP Masquerade Pro hides the oxygen folder in file addresses, the IDs of its CSS and JS files and the uploads/oxygen folder, but the oxy-* and ct-* classes and the OxygenFrontend JavaScript variable stay visible: it slows bots down, it doesn’t patch anything.
What WP Masquerade hides for Oxygen
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Oxygen: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- JavaScript variables
OxygenFrontend (Oxygen 6) - CSS classes
oxy-*, ct-*, oxygen-body
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Oxygen FAQ
Is Oxygen free?
You can download it and use every feature without a license. The site then shows a “Built with Oxygen” badge to visitors; the $199.50 lifetime license removes it.
What’s the difference between Oxygen 6 and Oxygen Classic?
Oxygen Classic is the older 4.x branch, which has its own website. Oxygen 6 runs on the engine it shares with Breakdance and adds AI agent connections; some third-party add-ons state which branch they support.
Do I need an AI subscription to use Oxygen?
No. Everything can be done by hand in the visual editor. To build with an agent, you bring your own (Claude, Codex, Cursor...) on whatever plan its vendor requires.
What happens to my pages if I deactivate Oxygen?
Their layout is stored in Oxygen’s data, not in the post content: without the plugin, it no longer displays. Plan to rebuild your pages before switching tools.