What Spectra does on your site
Spectra adds a library of layout and content blocks to the WordPress block editor: container, heading, buttons, info box, call to action, countdown, tabs, sliders, post grids and carousels, testimonials, a contact form, plus FAQ, How-To, review and table of contents blocks that output structured data. On top of that you get a popup builder, a coming soon or maintenance mode, block animations and local loading of Google Fonts.
Since version 2.20.0 (July 2026), the plugin is called Spectra Legacy. The vendor split the product in two: Spectra Legacy, the original plugin with the ultimate-addons-for-gutenberg slug, now only gets security, compatibility and critical bug fixes; Spectra Blocks, a separate plugin rebuilt on the newer WordPress APIs, gets every new feature. No migration is required, and both can run side by side during a transition.
For each post or page, Spectra generates the CSS and JavaScript of the blocks actually used, saved by default as files in wp-content/uploads/uag-plugin/. The vendor, Brainstorm Force, also makes the Astra theme; it sells a Pro version as well (Spectra Pro Legacy for this plugin), which adds the Loop Builder and registration and login forms, among other things.
When Spectra is worth keeping or installing
Spectra still makes sense in these cases:
- Sites already built with Spectra: your pages keep working, the plugin is still maintained and nothing forces you to migrate.
- Business sites on Astra or a lightweight theme: containers, buttons, info boxes and calls to action cover the basics without a separate page builder.
- Small sites that want a few tools without one more plugin: a contact form with reCAPTCHA, a popup, a coming soon page and Google Fonts served from your own server.
For a brand-new site, the answer is less obvious: Spectra Legacy will not get new features. Start with Spectra Blocks instead, which needs a recent PHP version, or compare it with Kadence Blocks. Spectra is also the wrong pick if you want a visual builder outside the block editor.
Spectra strengths and limitations
Strengths
- A large free library. Layout, content, post, form and SEO blocks, popups and maintenance mode are all in the free version.
- Assets loaded on demand. Each page only loads the CSS and JavaScript of the blocks it uses.
- Local Google Fonts. One option downloads the fonts to your server, which helps with GDPR and speed.
- Active maintenance. The vendor ships regular security fixes and offers a rollback to a previous version from the dashboard.
Limitations
- No new features anymore. Development has moved to Spectra Blocks, a different plugin you will eventually have to rebuild your pages with.
- Content tied to the plugin. The
uagb/*blocks no longer display properly if you deactivate Spectra. - Many published vulnerabilities. Most require a contributor account, but one 2026 flaw allowed code execution on the server.
- Advanced features cost extra. The Loop Builder and registration and login forms require the Pro version.
The Spectra settings we recommend
These settings exist in the current free version, under the Spectra Legacy menu in your dashboard. Each option is saved as soon as you change it.
| Setting | Recommended value | Why |
|---|---|---|
| Load Google Fonts Locally Spectra Legacy > Settings > Performance | On | Fonts are served by your server, with no call to Google’s servers on every visit. |
| Preload Local Fonts Same screen | Depends on the site | Useful when one or two fonts appear everywhere; measure speed before and after, since preloading too many files slows rendering. |
| File Generation Spectra Legacy > Settings > Asset Generation | On (default) | Block CSS and JavaScript are written to files that your caching plugin can serve and compress. |
| Regenerate Assets Same screen | After a migration or a change of site address | Rebuilds the files in uploads/uag-plugin if styles are missing on some pages. |
| Unused blocks Spectra Legacy > Blocks | Deactivated | Declutters the inserter; only deactivate a block that appears on none of your pages, or its content stops displaying. |
| reCAPTCHA v2 or v3 keys Spectra Legacy > Settings > Integrations | Filled in if you use the form block | Spectra’s contact form can then filter automated submissions. |
| Site Visibility Spectra Legacy > Settings > Site Visibility | Maintenance mode during a redesign, then off | Maintenance mode returns a 503 status, which search engines read as temporary downtime. |
| Rollback to Previous Version Spectra Legacy > Settings > Version Control | Troubleshooting only | An older version may contain a flaw that has since been fixed: go back to the latest version once the issue is solved. |
- After turning on local fonts, view a page’s source: no
fonts.googleapis.comURL should come from Spectra. - With coming soon or maintenance mode on, open the site in a private window: logged-out visitors should see the page you picked, which must be published.
- Clear your site cache after regenerating assets, then check a few pages built with Spectra.
- In Plugins, check that Spectra is on the latest version and that auto-updates are on.
Spectra security: frequent flaws, mostly at contributor level
Spectra ships security fixes often: almost every release since June 2026 includes one. The most common family is stored XSS from a contributor account, which plants a script in a poorly escaped block attribute. The cases worth knowing:
- CVE-2026-7465, fixed in 2.19.26: a contributor could get PHP code executed on the server through block attributes, a form of remote code execution (CVSS 8.8).
- CVE-2026-24982, fixed in 2.19.18: missing access control, exploitable without an account (CVSS 5.3).
- CVE-2026-12900, versions up to 2.19.28: stored XSS through the image block, with a contributor account (CVSS 6.4).
- CVE-2026-10827, fixed in 2.20.0: a contributor could inject CSS served to anonymous visitors, enough to deface a page or load external resources.
The changelog for 2.20.1 through 2.20.6 lists more security fixes. So turn on auto-updates for Spectra (see our guide to automatic plugin updates), give the contributor role only to people you trust, and read the ecosystem timeline in our article on Astra theme security. WP Masquerade Pro renames the uagb and spectra identifiers of scripts and stylesheets as well as the uploads/uag-plugin folder, while the uagb-* classes stay visible: this makes the plugin harder for bots to spot, but it does not replace updating.
What WP Masquerade hides for Spectra
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Spectra: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- CSS classes
uagb-*, wp-block-uagb-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Spectra frequently asked questions
Why is Spectra now called Spectra Legacy?
Since version 2.20.0, the vendor has separated the original plugin, renamed Spectra Legacy, from Spectra Blocks, a new plugin where new features land. The rename changes neither your blocks nor your settings.
Do I need to migrate to Spectra Blocks?
Nothing requires it and the vendor has announced no deadline: Spectra Legacy keeps getting security and compatibility fixes. You can install Spectra Blocks alongside it, build new pages with it, then deactivate Spectra Legacy once no page uses its blocks anymore.
What happens to my pages if I deactivate Spectra?
Spectra blocks lose their styling and some no longer display properly. Test on a copy of the site first and rebuild the affected pages before deactivating the plugin.
How much does Spectra Pro cost?
The official pricing page lists Spectra Pro at $69 per year for 3 sites, or $319 as a one-time payment, with a 14-day money-back guarantee. Pricier bundles add Astra Pro, premium templates and AI tools for 10 or 1,000 sites.