What Table of Contents Plus does on your site
Table of Contents Plus, often shortened to TOC+, reads the heading tags of a post or page and automatically inserts a clickable table of contents into the content. There is no block to add and no shortcode to remember: once you pick the post types, every piece of content with enough headings gets its table of contents, rebuilt on each page load. Each heading gets an anchor (for example #getting-started) and a click scrolls smoothly down to that section.
The plugin also adds a widget to show the table of contents in a sidebar, the [toc] shortcode to place it by hand, [no_toc] to remove it from one post, and the [sitemap], [sitemap_pages], [sitemap_categories] and [sitemap_posts] shortcodes, which print an HTML list of your pages, categories or posts. That is not an XML sitemap. The table of contents container carries a navigation role for screen readers and the data-nosnippet attribute, which asks search engines not to use it as the snippet in results.
Originally created by Michael Tran, the plugin is now maintained by the All in One SEO team (Awesome Motive). It is completely free, with no paid edition. Its settings screen, rebuilt in July 2026, lives under the ToC+ menu in four tabs: Display, Appearance, Behavior and Advanced. The labels quoted below are the ones the English interface shows.
Which sites Table of Contents Plus suits
- Blogs with long posts (guides, tutorials, recipes) that want a table of contents on every article without thinking about it each time they publish.
- Documentation and knowledge bases, where readers look for one specific section and share a direct link to a heading.
- Sites that want a table of contents in one section only: the "Restrict to path" setting limits it to URLs that start with a given path, such as
/guides/.
It is not the right pick if you want to place and tune a different table of contents in each post from the block editor: the plugin works mostly through global settings and a shortcode. It is not the right pick for a site with short pages either, or if your theme or block plugin already provides a table of contents. For a free alternative that also has a Pro edition, see Easy Table of Contents.
Table of Contents Plus strengths and limitations
Strengths
- Automatic insertion. The table of contents appears as soon as the heading threshold is reached, on the post types you choose, including custom post types that use
the_content(). - Fine-grained filtering. Choose the heading levels, exclude headings by their text with the
*wildcard, and use[no_toc]on a single post. - Readable anchors. Lowercase and hyphenated by default, easy to share and cite.
- Light files. One stylesheet and one script, about 9 KB together, with no external service.
- Completely free. Color themes, live preview, widget and content lists, with no paid tier.
Limitations
- Loaded on every page. The script, which depends on jQuery, and the stylesheet are added to every front-end page, even without a table of contents.
- Little control in the editor. Apart from the shortcode and its attributes, there is no per-post setting in the block editor.
- Uneven translations. Dutch is nearly complete, but French, German, Spanish and Italian cover only about thirty labels, so the screen stays mostly in English for those users.
- Every heading by default. Levels H1 to H6 are included until you narrow them down, which can make the list long.
The Table of Contents Plus settings we recommend
All settings are under ToC+ > Settings, available to administrators only.
| Setting | Recommended value | Why |
|---|---|---|
| Auto-insert for ToC+ > Settings > Display tab > Auto-insert | Posts, and pages only if they are long | A table of contents only helps where content has several sections. |
| Position Same section | "Before first heading (default)", or "After first paragraph" to keep the introduction on top | Readers first see what the page is about, then the outline. |
| Minimum headings Display tab > Display Conditions | 3 (default), or 4 on a blog with medium-length posts | Avoids a two-line table of contents on short content. |
| Heading levels Display tab > Headings | H2 and H3 | H4 to H6 make the list longer without helping navigation. |
| Exclude headings Same section | Recurring headings, separated by a pipe, for example FAQ*|Sources | The list only shows the sections specific to each piece of content. |
| Smooth scrolling and Top offset (px) Behavior tab > Scrolling | On, with an offset equal to the height of your sticky header (30 by default) | Otherwise a sticky header hides the heading you land on; test on desktop and on a phone. |
| Lowercase anchors and Hyphenate anchors Advanced tab > Anchors | On (default), and left unchanged on a live site | Changing them rewrites every anchor and breaks links already shared to your sections. |
| Disable plugin CSS Appearance tab > CSS | Off, unless your theme styles the table of contents itself | Without the plugin stylesheet, the table of contents loses its box and color themes. |
| Updates Plugins > Installed Plugins | Auto-updates enabled | All past vulnerabilities were fixed through updates (see below). |
- Open a long post and check that the table of contents appears where you chose, with only the levels you want.
- Click a table of contents link with the sticky header visible: the heading you land on must stay readable below the header.
- Check that the home page stays free of a table of contents if you do not want one there ("Show on the homepage" is off by default).
- If your cookie banner lists trackers, add
tocplus_hidetoc: this functional cookie remembers for 30 days that a visitor collapsed the table of contents on a page.
Patched vulnerabilities in Table of Contents Plus
Patchstack lists five patched vulnerabilities and no open one in the current version. Two are stored XSS flaws: CVE-2022-4479 affected versions before 2212, where a contributor could slip code into shortcode attributes; CVE-2024-5578, described for versions up to 2408, let an editor inject code through the settings, even without the unfiltered_html capability.
Two more are CSRF flaws, which could make a logged-in administrator perform an action by tricking them into clicking a link: CVE-2023-44473 up to version 2302, fixed in 2309, and CVE-2024-49250 up to version 2408, fixed in 2411. The fifth, a stored XSS limited to administrators, was fixed in 2309. Version 202609.1 from September 2026 adds another round of security hardening.
What helps: auto-updates, and contributor and editor roles given only to people who need them. WP Masquerade Pro renames the table-of-contents-plus folder in file URLs and in the tag IDs of its stylesheets and scripts, but #toc_container, the tocplus JavaScript variable and the toc_* classes stay visible, and the free version does not hide this plugin. This makes the plugin harder for bots to spot, but it fixes no vulnerability.
What WP Masquerade hides for Table of Contents Plus
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Table of Contents Plus: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- tag IDs
#toc_container - JavaScript variables
tocplus - CSS classes
toc_*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Table of Contents Plus FAQ
How do I remove the table of contents from a single post?
Add the [no_toc] shortcode anywhere in the content. To do the opposite and place the table of contents at a precise spot, put [toc] there.
Why doesn't the table of contents show up on a page?
Check that its post type is ticked in "Auto-insert for", that it has at least the number of headings set in "Minimum headings", and that "Restrict to path" does not exclude it. With automatic insertion, archives, search results and the posts page never show one.
Does the table of contents help SEO?
It makes reading easier and provides anchors that Google sometimes shows as jump-to links in its results, with no guarantee. The data-nosnippet attribute keeps the table of contents from being used as the snippet.
Can I show the table of contents in the sidebar?
Yes, with the plugin's widget, which follows the content being viewed. With the "Widget only" option in the Advanced tab, it is no longer inserted into the content of the chosen post types and only appears where you place the widget.