Download websites that use Astra Widgets

About Astra Widgets

A companion plugin is a dependent fingerprint, and reading it as an independent one leads to bad conclusions. Astra Widgets extends a theme rather than standing alone, so a match implies the theme is present as well, and the site's real platform decision was made when the theme was chosen. What the plugin adds is narrower and more specific: the site wanted widget types the theme does not ship on its own, which usually means somebody was assembling a layout by hand in the customiser instead of accepting the defaults.

Version reporting is available for this fingerprint, which is not true of every technology we track, and the version field is where the record becomes analytically interesting. We see 46 distinct releases in circulation, with 1.2.15 the typical one. A spread that wide across a plugin distributed through an automatic update channel is a finding in its own right. Software that updates cleanly converges on a narrow band of releases within weeks of a push. A long tail means installs where automatic updates are switched off, where the platform is pinned by a host, or where the owner walked away without uninstalling anything.

The licence explains part of the fragmentation. Astra Widgets is PHP code published under a GPL v2 licence by Brainstorm Force, and free redistribution means it arrives bundled inside site templates, cloned staging environments and hosting starter stacks, none of which are maintained the way a purchased product would be. Code that nobody paid for is code nobody feels responsible for updating.

Since 2017 the plugin has travelled alongside a theme from the same vendor rather than standing on its own, and the pairing is the reason a researcher would want the list. Sites carrying it are running a theme and a companion plugin from one supplier, which means the owner installs third party code willingly and is already addressable through that supplier's own channels. As of October 2026 we detect Astra Widgets on 2,906 sites, small enough to work through as a target list and large enough to segment meaningfully.

Segmentation is where the version field does work a lookup cannot. Asking whether one domain runs the plugin is a single request with a yes or a no attached. Asking which sites run a release behind the current one, and then crossing that with country, registry suffix and the rest of the detected stack, needs every row in one place. Security teams use the version spread to bound exposure before scanning. Vendors use it to find installs that stopped updating, on the reasonable theory that a site which stopped taking plugin updates has stopped taking attention generally.

Detection of a companion plugin depends on it emitting something visible in a delivered page. Installs whose widgets render nothing on the pages we fetch leave no trace, so the count is a floor and the version distribution describes the visible installs rather than every copy on disk.