What WPML does on your site
WPML makes WordPress multilingual by linking each piece of content to its translations: a page, post, category or menu exists in every language, and all languages stay in the same WordPress database. On the front end, the plugin puts the language in the URL (a directory, a separate domain or a ?lang= parameter), adds a language switcher and prints hreflang tags for every translated version in the page head.
You can translate in several ways: in the WordPress editor, in WPML’s Advanced Translation Editor (source and translation side by side), with your own translators, through partner agencies, or with PTC, WPML’s AI translation engine. Add-ons cover theme and plugin strings (String Translation), media, a WooCommerce store with multiple currencies, ACF fields, and forms built with Gravity Forms, WPForms, Ninja Forms or Contact Form 7.
The vendor, OnTheGoSystems Limited, does not publish WPML on wordpress.org and offers no free version. You first install a small plugin, OTGS Installer, which downloads WPML and its add-ons and keeps them updated once the site key is registered. Every plan includes one year of support and updates.
Which sites WPML is a good fit for
WPML earns its price when a site goes beyond standard content and the translation has to cover everything visitors see:
- Multilingual stores: with the Multilingual CMS plan, the WooCommerce add-on translates the store and handles multiple currencies at no extra cost.
- Sites built with Elementor or another page builder: translating layouts, headers and Site Editor templates is included from Multilingual CMS up.
- Sites translated by a team or an agency: Translation Management splits the work between translators and partner services, with XLIFF file exchange.
- Agencies that ship many sites: Multilingual Agency covers unlimited sites under one account.
It is not the right choice for a small blog with no budget: Polylang translates posts, categories and menus for free. A hosted service such as Weglot spares you from managing every translation as WordPress content. And the Multilingual Blog plan only suits a very simple site, since it leaves out menu translation.
WPML strengths and limitations
Strengths
- A complete ecosystem. WooCommerce with multiple currencies, ACF, forms, page builders and the Site Editor are all covered by the vendor’s own add-ons.
- AI translation included. 22,500 words with Multilingual CMS and 45,000 with Multilingual Agency, topped up at each renewal and never expiring.
- A real translation workflow. The side-by-side editor, in-house translators and partner services are all managed from the dashboard.
- Nothing breaks when the license lapses. Without a renewal, WPML keeps working and translations stay online; you lose updates and support.
Limitations
- No free version. Every site needs a license, and updates come through OTGS Installer with a registered site key.
- A heavily restricted entry plan. Multilingual Blog leaves out String Translation, menus, WooCommerce, page builders and AI translation.
- A heavy plugin. The vendor requires at least 128 MB of PHP memory (256 MB recommended) and the ability to create its own database tables.
- Serious vulnerabilities in recent years. A code execution flaw in 2024 and two SQL injections in 2026, all exploitable with a logged-in account.
The WPML settings we recommend
These options live under WPML > Settings, on the “URLs and SEO” screen of the current version. Lock in the URL format before you publish translations: changing it later moves URLs that are already indexed.
| Setting | Recommended value | Why |
|---|---|---|
| Language URL format WPML > Settings > URLs and SEO | “Different languages in directories” (default) | All languages stay on one domain with no extra DNS or certificate; a domain per language mainly serves country targeting. |
| Use directory for default language Same section | Off (default) | Pages in the main language keep their current URLs and existing links. |
| Page URL Same screen | “Translate” if your translators care about slugs, otherwise “Auto-generate from title” (default) | Avoid the option that rebuilds the slug on every title change: it overwrites hand-picked slugs. |
| Display alternative languages in the HEAD section Same screen, SEO Options card | On (default) | hreflang tags tell search engines which version to serve in each language. |
| Position of hreflang links Same card | “As early as possible” (default) | Change it only if your theme or SEO plugin places its own tags in a conflicting position. |
| New visitors whose browser uses another language Same screen, Visitor language section | “Keep them on the page they opened” (default) or the suggestion bar | WPML warns that the automatic redirect can hurt Google indexing; the bar does not. |
| Show the site in the language they last picked in the language switcher Same section | On only if visitors often switch languages | The choice is stored in the _icl_visitor_chosen_lang cookie for the period you set. |
- View the source of a translated page: you should see one
link rel="alternate" hreflangtag per language. - Use the switcher on a page, a category and the home page: every link should lead to the translation.
- Check that the site key is registered in OTGS Installer: without it, WPML receives no fixes.
- List the WPML cookies, including
wp-wpml_current_language, in your cookie policy.
WPML security: serious flaws, limited to logged-in accounts
According to Patchstack and Wordfence, the notable WPML vulnerabilities require an account on the site, sometimes just a subscriber:
- CVE-2024-6386, fixed in 4.6.13: server-side code execution through Twig template injection, with a contributor account (CVSS 9.9).
- CVE-2025-3488, fixed in 4.7.4: stored XSS through the
wpml_language_switchershortcode, with a contributor account (CVSS 6.4). - CVE-2026-12248, fixed in 4.9.6: SQL injection through the
sortingparameter, with a translator account (CVSS 6.5). - CVE-2026-17509, fixed in 4.9.6: SQL injection through the
elementIdsparameter, from a subscriber account up (CVSS 6.5).
Run at least 4.9.6 and keep your license active: without it, no fixes arrive. If your site allows public registration, restrict the roles you grant (see our guide to WordPress roles and capabilities) and follow alerts for your plugins (see monitoring your plugins for vulnerabilities). WP Masquerade Pro replaces the sitepress-multilingual-cms folder URLs and removes the wpml IDs from scripts and styles; the wp-wpml_current_language cookie and the switcher’s wpml-ls-* classes remain visible, and this masking does not replace updating.
What WP Masquerade hides for WPML
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to WPML: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- generator tag
- folder name
- tag IDs
Still visible
- cookies
wp-wpml_current_language - CSS classes
wpml-ls-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Frequently asked questions about WPML
Is there a free version of WPML?
No. WPML is sold only under license, with a 30-day money-back guarantee. For a free multilingual site, Polylang is the closest alternative in how it works.
How much does WPML cost, and for how many sites?
The official pricing page lists Multilingual Blog at €39 per year excluding VAT for one production site, Multilingual CMS at €99 for three sites and Multilingual Agency at €199 for unlimited sites. Each plan also includes development sites, which show a WPML banner on the front end.
What happens if I don’t renew my WPML license?
The site keeps working and translations stay online. You no longer get new versions, so no security fixes either; automatic translation works as long as you have words left.
Does WPML translate content automatically?
Yes, with PTC, its AI translation engine, from the Multilingual CMS plan up. Each site gets 500 free words to start, then you use your plan’s words or buy more.
Can I switch from WPML to Polylang?
Yes. The Polylang team offers a free plugin, WPML to Polylang, that carries over existing translations. Test it on a copy of the site first.