--- title: "Polylang" description: "Polylang free or Pro: strengths, limitations, pricing, recommended URL and language settings and patched vulnerabilities, to decide and set it up well." language: "en" locale: "en-US" type: "plugin-sheet" canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/polylang/" published: "2026-11-04T08:00:00+00:00" modified: "2026-11-06T08:08:18+00:00" translations: en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/polylang/index.md" fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/polylang/index.md" es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/polylang/index.md" de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/polylang/index.md" it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/polylang/index.md" pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/polylang/index.md" nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/polylang/index.md" --- # Polylang Polylang makes WordPress multilingual by linking translations of your posts, menus and categories, with per-language URLs and hreflang tags. Our take on the free and Pro versions, the URL settings to lock in before you publish and the vulnerabilities already fixed. ## The essentials - Best for business sites and blogs you translate yourself while keeping standard WordPress content. - Main caveat: WooCommerce needs a paid add-on, and machine translation is Pro only. - Free; Pro from €99 per year excl. VAT adds translated slugs, DeepL and XLIFF exchange. ## What Polylang does on your site Polylang makes WordPress multilingual without changing how you write. You create a post, page or category as usual, assign it a language, then add its translation from the Languages column or panel. Each translation is a regular WordPress post linked to its other versions. The plugin builds on WordPress’s own taxonomies, puts no cap on the number of languages and downloads WordPress language packs automatically. On the front end, Polylang puts the language in the URL (a directory such as `/en/`, a subdomain or a separate domain), adds a language switcher (block, classic widget or menu item) and outputs [hreflang](https://www.wp-masquerade.com/glossary/hreflang/) tags in the page head, including an `x-default` value. It also translates classic menus, widgets and, under Languages > Translations, strings such as the site title. It remembers the visitor’s choice in a cookie, `pll_language`, which lasts one year by default. The developer, WP SYNTEX, sells Polylang Pro, which shares the same core and adds slug translation, synchronized posts, XLIFF export and import, DeepL machine translation and deeper integration with the block editor and the site editor. WooCommerce needs a separate paid add-on, Polylang for WooCommerce. ![Diagram: Polylang works on visitors and bots, wordpress, database and files. Public traces: branded HTTP header (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); cookies (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/polylang/diagram-en.svg?v=9bcfbc40) ## Which sites Polylang suits best Polylang is a good fit when you, or a translator, write the translations and you want to keep standard WordPress content: - **Business sites and blogs in a handful of languages**: the free version covers content, categories, menus, the switcher and hreflang tags. - **Sites that want a domain or subdomain per country**: both URL modes are included in the free version. - **Agencies building multilingual sites**: staging sites and local addresses don’t count against the site limit of a Pro license. - **Sites moving away from WPML**: the developer offers a free plugin, WPML to Polylang, to migrate existing translations. It’s the wrong pick for a multilingual store on a zero budget: [WooCommerce](https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/) requires the paid Polylang for WooCommerce add-on. And if you’re counting on machine translation for the whole site, the free version doesn’t offer it, so weigh Polylang Pro against [WPML](https://www.wp-masquerade.com/features/camouflaged-plugins/wpml/) or [Weglot](https://www.wp-masquerade.com/features/camouflaged-plugins/weglot/). ## Polylang strengths and limitations ### Strengths - **A complete free version for content sites.** Posts, media, custom post types, menus, widgets and settings strings can all be translated without a license. - **Built on WordPress itself.** Languages rely on native taxonomies, and every translation stays an ordinary post that your backups include. - **Multilingual SEO basics out of the box.** hreflang tags with `x-default`, one URL per language and Yoast SEO compatibility, with no setup. - **A Pro license that doesn’t lock anything when it lapses.** Without renewal the plugin keeps working; you only lose updates and support. ### Limitations - **WooCommerce costs extra.** Products, checkout pages and emails can only be translated with the paid Polylang for WooCommerce add-on. - **Slug features are Pro only.** Sharing one slug between two translations or translating custom post type URL bases requires Polylang Pro. - **No machine translation for free.** DeepL comes only with Pro, using your own API key, and the developer says it doesn’t work with Elementor yet. - **Work on every post.** Each translation is a separate post to create and keep current; duplication and synchronized posts are in Pro. ## The Polylang settings we recommend These modules live under Languages > Settings in the current free version. Settle the URL options before you publish translations: changing them later alters URLs that search engines have already indexed. | Setting | Recommended value | Why | | --- | --- | --- | | **The language is set from the directory name in pretty permalinks** Languages > Settings > URL modifications | On, for a site on a single domain | Clean `/en/` URLs with no extra DNS or certificate; separate domains mainly make sense for country targeting. | | **Hide URL language information for default language** Same module | On (default) | Pages in your main language keep their current URLs and existing links. | | **Remove /language/ in pretty permalinks** Same module | On (default) | URLs read `/en/` instead of `/language/en/`. | | **The front page URL contains the language code instead of the page name or page id** Same module | On if your homepage is a static page | The English homepage answers at `/en/` rather than at the translated page’s address. | | **Detect browser language** Languages > Settings | Off, unless you really need it | It redirects the homepage based on the browser and disables caching of that page for known cache plugins; test with your cache if you turn it on. | | **Media** Languages > Settings | On only if you translate alt text and captions | Files aren’t duplicated, but every media item gets a language and translations to manage. | | **Custom post types and Taxonomies** Languages > Settings | Check only the types you translate | A technical post type (forms, a plugin’s templates) doesn’t need a language. | | **Synchronization** Languages > Settings | Featured image, Page template and Page parent checked | These are usually identical across languages; leave Custom fields unchecked if your translations use different ones. | - View the source of a translated page: you should see one `link rel="alternate" hreflang` tag per language, plus `x-default`. - Open Languages > Languages: no warning about content without a language should remain. - Switch languages from a page, a category and the homepage: each link should lead to the matching translation. - List the `pll_language` cookie in your cookie policy and check the consent rules that apply where you operate. ## Polylang security: flaws that need a contributor account Polylang runs a vulnerability disclosure program through Patchstack and lists its fixes in the changelog. Every flaw published since 2025 requires at least a contributor account: - **CVE-2025-64353, fixed in 3.7.4**: deserialization of untrusted data (CVSS 8.8). - **CVE-2026-65458, fixed in 3.8.6**: exposure of private posts’ metadata, Polylang Pro included (CVSS 4.3). - **CVE-2026-39783, fixed in 3.8.8**: exposure of draft posts’ metadata (CVSS 4.3). - **CVE-2026-97279, fixed in 3.8.10**: XSS through a block attribute, which needs a logged-in user to take an action (CVSS 6.5). Version 3.8.11, released in October 2026, fixes another deserialization issue. Turn on auto-updates for Polylang (see our guide to plugin auto-updates) and, if you use Pro, keep the license active so you keep getting its fixes. WP Masquerade Pro removes the HTTP header carrying Polylang’s name that its redirects send and gives the `pll_language` cookie a neutral name, without changing the remembered language; the `lang-item` classes stay visible, and this masking is no substitute for updating. ## Polylang FAQ **Is the free version of Polylang enough?** For a business site or a blog without a store, often yes: content, categories, menus, the switcher, hreflang and per-language domains are all free. Pro pays off when you need translated slugs, synchronized posts, XLIFF files for a translator or DeepL. **How much does Polylang Pro cost?** The official pricing page lists Polylang Pro from €99 per year excluding VAT, with multi-site licenses and a 50% renewal discount. The Business Pack, which adds Polylang for WooCommerce, is listed from €139 per year excluding VAT. **Does Polylang translate content automatically?** Not in the free version. Polylang Pro translates a post with DeepL from the edit screen, using your own DeepL API key. **Can I run Polylang without the pll_language cookie?** Yes, by setting the `PLL_COOKIE` constant to `false` in wp-config.php. The developer warns that the language may then not always be detected, for example in AJAX requests or on the login page. **Does Polylang translate theme and plugin strings?** It loads their existing translations in each page’s language. To fix or complete those translation files, a dedicated plugin such as [Loco Translate](https://www.wp-masquerade.com/features/camouflaged-plugins/loco-translate/) is the better tool. ## Key facts - Category: Languages and translation - Vendor: WP SYNTEX - Price: Free; Polylang Pro from €99 per year excluding VAT - Active installations (wordpress.org): 900 000+ - Version: 3.9.1 - Official page: https://wordpress.org/plugins/polylang/ ## What WP Masquerade hides - Handled by WP Masquerade Pro only - With Pro: branded HTTP header, cookies, folder name, tag IDs - Still visible: CSS classes