What TranslatePress does on your site
TranslatePress translates a WordPress site from the page itself. You open the translation editor, the page appears exactly as your visitors see it, you click a piece of text and type its translation. Everything is covered: content, menus, theme strings, and output from page builders, forms and WooCommerce. Each post stays a single post: translations live in separate tables in your database, and the plugin swaps them in for the original text when the page is rendered.
Translated pages get their own URLs, with one subdirectory per language (/en/, /de/), and the plugin adds hreflang tags in the head that link the versions together. The language switcher can be added as a menu item, a block, the [language-switcher] shortcode or a floating dropdown. For automatic translation, the free version offers TranslatePress AI up to 2,000 words, or Google Translate with your own API key, whose usage Google may bill you for.
The developer, Cozmoslabs, sells three yearly licenses. They unlock extra languages (the free version is limited to one translation language), the SEO Pack add-on to translate slugs, titles and meta descriptions, a quota of words translated by TranslatePress AI and, from the Business plan up, DeepL, translator accounts and automatic detection of the visitor’s language.
Which sites TranslatePress is a good fit for
TranslatePress works well when you want to translate what your visitors actually see, without managing a copy of every post:
- Bilingual sites: the free version covers one main language and one translation language, with no page limit.
- Sites built with Elementor, Divi or another page builder: you translate the final output, including module text that classic translation screens tend to miss.
- WooCommerce stores: product pages, cart, checkout and emails are translated in the same visual editor.
- Small teams without a dedicated translator: a first automatic pass, then a page-by-page review.
It is not the best choice if you want each translation to be real WordPress content, with its own author, categories or a different layout per language: Polylang creates a separate post for each language. If you need more than two languages, budget for a paid license from day one.
TranslatePress strengths and limitations
Strengths
- Translation in context. You see the real page while you translate, which avoids text that runs too long or misses the point.
- No forgotten strings. Theme and plugin strings are translated in the same place as your content.
- Translations stay with you. Everything lives in your database, and your translations keep showing if you do not renew the license.
- API cost control. Crawler blocking and a daily character cap keep automatic translation from running away.
Limitations
- One translation language in the free version. Anything beyond a bilingual site needs a paid license.
- Paid multilingual SEO. Slugs, titles, meta descriptions and social tags are translated with the SEO Pack, which the free version lacks.
- DeepL and translator accounts start at Business. The €99 Personal license does not include them.
- A run of vulnerabilities in 2026. Between August and October, about ten flaws were patched, including a critical one exploitable without an account.
The TranslatePress settings we recommend
All these settings exist in the current free version, under Settings > TranslatePress. Save each tab, then run the checks below.
| Setting | Recommended value | Why |
|---|---|---|
| Default Language Settings > TranslatePress > General | The language your content is written in | Changing it later invalidates every existing translation, even from en_US to en_GB. |
| Use a subdirectory for the default language Same screen | Off (default) on an existing site | URLs in your main language stay the same; only translations get a prefix such as /en/. |
| Force language in custom links Same screen | On (default) | A hand-typed link keeps visitors in the language they chose. |
| Enable Automatic Translation Settings > TranslatePress > Automatic Translation | On only if someone reviews the output | Machine translation published without review shows, especially on sales pages. |
| Block Crawlers Same tab, Advanced subtab | On (default) | Bots crawling your pages do not trigger automatic translations at your expense. |
| Limit machine translation / characters per day Same screen | On with Google Translate or DeepL | Usage of these APIs may be billed separately: a daily cap protects your budget if something goes wrong. |
| Log machine translation queries Same screen | Off (default) | The developer reserves this log for testing, since it can slow the site down. |
| Manual Translation Only Settings > TranslatePress > Advanced | Depends on the site: consider it once translations are done | Strings are no longer saved on every visit, only in the translation editor; in exchange, new content is no longer translated automatically outside the editor. |
- Open a page in the translated language: its URL should start with the language prefix, for example
/en/. - View the source of the same page: you should find one
link rel="alternate" hreflangtag per published language. - Switch languages with the switcher, then click a menu link: you should stay in that language.
- In Plugins, check that TranslatePress runs at least version 3.3.8, which fixes the latest published flaw.
TranslatePress security: a busy fall 2026
TranslatePress reads and rewrites the HTML of every page, including text submitted by visitors such as comments: that is where its flaws cluster. After two deserialization flaws in 2025, the Patchstack database lists about ten fixes between August and October 2026. The most important ones:
- CVE-2025-58592, fixed in 2.10.3: PHP object injection without an account (CVSS 8.1).
- CVE-2026-19632, fixed in 3.3.2: an unauthenticated visitor could retrieve an administrator’s password reset link, stored in the translation table, and take over the account (CVSS 9.8). It required automatic string saving to be on, which is the default, and the administrator’s profile language to be a published translation language. Patchstack flags it as exploited and also lists it as CVE-2026-78267.
- CVE-2026-89412, fixed in 3.3.6, and CVE-2026-107768, fixed in 3.3.8: unauthenticated stored XSS, the second through a comment published without moderation (CVSS 7.2).
Given the pace of fixes, turn on automatic updates for TranslatePress in Plugins (see our guide to automatic plugin updates); if your comments go live without approval, switch them to moderation. WP Masquerade Pro removes the TranslatePress folder name from its file URLs and its tag IDs, which makes the plugin harder to spot for bots targeting these flaws; the trp_* JavaScript variables and trp-* classes stay visible, and this masking does not replace updating.
What WP Masquerade hides for TranslatePress
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to TranslatePress: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
trp_* - CSS classes
trp-*, translatepress-{locale}
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
TranslatePress frequently asked questions
Is the free version of TranslatePress enough?
For a bilingual site, often yes: the visual editor, theme and plugin translation, the language switcher and hreflang tags are free. You need a license for a third language, to translate slugs and SEO metadata, or for a real AI translation quota.
How much does TranslatePress cost, and for how many sites?
The official page lists €99 per year for one site (Personal, 50,000 AI words), €199 for three sites (Business, 200,000 words) and €349 for unlimited sites (Developer, 500,000 words). Licenses renew automatically each year and come with a 15-day refund window.
What happens if I do not renew the license?
According to the developer, the plugin keeps working and your translations keep showing. You lose access to TranslatePress AI, some premium features, new releases and downloads.
Does TranslatePress slow down my site?
The developer claims a small impact, but the plugin swaps text in as each translated page is rendered. Since every translated version has its own URL, a caching plugin such as LiteSpeed Cache caches it like any other page.