Is Divi secure for client websites?

Yes, Divi can be considered secure. While there has been a pattern of authenticated stored XSS vulnerabilities, these typically require a malicious user to have at least 'Contributor' level access to the site [1]. The Elegant Themes development team has a strong track record of patching and disclosing vulnerabilities proactively and rapidly, often within days of a report [1, 4].

How does Divi's performance compare to other builders like Bricks or Elementor?

The current version, Divi 4.x, is generally considered slower than modern builders like Bricks or block-based themes without aggressive caching and optimization [6]. However, the upcoming Divi 5 is a complete rewrite focused on performance, with early reports showing it is significantly faster and aims to be competitive with the fastest builders on the market [1, 5].

Does Divi work well with multilingual plugins like WPML?

Compatibility has been mixed. On large WooCommerce sites, the combination of Divi and WPML has historically led to performance issues and database bloat [8]. However, both development teams are actively working on improvements, and a recent WPML beta was released specifically to improve compatibility with the new architecture of Divi 5 [7].

Can I use Advanced Custom Fields (ACF) Repeater fields with Divi?

Not natively. The Divi Builder does not support ACF Repeater fields or other complex field types out of the box. To display this type of data, you will need to write custom PHP in a child theme or use a third-party plugin that bridges the gap [9].

What is the main difference between Divi 4 and the upcoming Divi 5?

The primary difference is performance and architecture. Divi 4 is built on a legacy system of shortcodes, which can be slow and contribute to vendor lock-in. Divi 5 is a modern, HTML5-based framework that removes shortcodes entirely, resulting in dramatically faster page rendering and a more efficient build process [1, 5].

Is Divi a good choice for an agency managing hundreds of websites?

Yes, Divi is an excellent choice for agencies due to its licensing model. The one-time Lifetime Access fee allows for use on unlimited websites, offering a significantly better long-term return on investment compared to the per-site or annual subscription models of competitors like Elementor [1, 12].

How responsive is the support team at Elegant Themes?

The support team is widely praised as being industry-leading. Users report extremely fast response times, often within 15 minutes, available 24/7 via live chat, which is a major benefit for resolving critical issues quickly [13].

What happens when a major WordPress update is released? Does it break Divi sites?

Occasionally, major WordPress updates can cause minor cosmetic issues. For example, WordPress 6.6 introduced global styles that caused all links on Divi sites to become underlined. The Divi team addressed this with a patch in a subsequent theme update [2]. It is always recommended to test core updates on a staging site first.

Divi - Theme Scout

Name: Divi
Price: 89 USD
Availability: InStock
Author: Elegant Themes

Overview

Safe to use

Divi is a powerful visual builder with excellent agency value (unlimited site lifetime license at $249). Divi 5, officially released February 2026, is a complete architectural rewrite removing legacy shortcodes in favor of HTML5, promising major performance gains. The ecosystem is in transition — Divi 4 remains supported but new builds should target Divi 5. Of the 10 reported issues, most relate to the legacy 4.x branch.

Pros

Excellent value for agencies
Powerful visual builder
Extremely responsive support

Cons

Steep learning curve for clients
Legacy shortcodes create lock-in
Historical performance issues

Analysis

Divi is a comprehensive WordPress theme and visual page builder developed by Elegant Themes, aimed primarily at web design agencies, freelancers, and users who desire deep customization control without writing code. Its main appeal lies in the all-in-one package, which includes the powerful Divi Builder, hundreds of pre-made layouts, and additional plugins for email opt-ins and social sharing. The lifetime, unlimited-site license offers exceptional value for professionals managing a large portfolio of client websites.

The primary trade-off with Divi has historically been its performance and architecture. The current version relies on a shortcode-based system that can feel bloated compared to modern, block-based alternatives and creates a degree of “lock-in,” making it difficult to switch themes later. However, the development team is actively addressing these criticisms with the upcoming Divi 5, a complete architectural rewrite that promises massive speed improvements and a more future-proof foundation. While security vulnerabilities have been discovered in the past, the developer’s response is consistently fast and transparent.

Divi’s ecosystem is robust, featuring extremely responsive 24/7 customer support and powerful tools for agency workflows, such as a detailed Role Editor for managing client permissions. While it has some compatibility limitations with advanced custom fields and can experience performance issues in complex multilingual e-commerce setups, it remains a dominant and highly capable tool for building visually rich websites.

Performance

Core Web Vitals (mobile)

Metric	Mobile	Desktop	Target
LCP (Largest Contentful Paint)	`2.02`	`1.54`	< 2.5s
CLS (Cumulative Layout Shift)	`0.06`	`0.09`	< 0.1

The theme's demo site achieves a Mobile PageSpeed score of 71/100, which is considered good, with healthy Core Web Vitals [LCP 2.02s, CLS 0.06]. However, community reports for the current 4.x branch indicate that achieving good scores on real-world sites often requires aggressive caching and optimization plugins [6]. The upcoming Divi 5 release is widely reported to bring significant performance enhancements that address these legacy issues [1, 5].

When performance is acceptable

Divi is a safe choice for new projects, especially with the upcoming Divi 5 release which promises a complete performance overhaul, making it competitive with modern block-based builders [5].

Performance concerns

Use caution when deploying the current Divi 4.x on content-heavy websites or for clients who demand top-tier performance scores, as it may require significant manual optimization and a premium hosting environment to compete with lighter themes [6].

Avoid if performance matters

Avoid using Divi 4.x for projects with extremely tight performance budgets or on low-cost shared hosting, as its legacy architecture can struggle under load without proper caching and optimization infrastructure [6].

Tested URL: https://www.elegantthemes.com/layouts/business/restaurant-landing-page/live-demo. View PageSpeed Insights report.

Client Handoff

5.0

out of 10

How easy it is to hand this theme off to a client without ongoing developer support.

Score breakdown

Criterion	Rating
Panel complexity	complex
Documentation quality	good
Learning curve	days

When it works well

Divi is safe for agency-to-client handoffs where the agency provides custom training documentation and uses the built-in Role Editor to restrict client access to advanced features [11].

Use caution when

Use caution when handing off a Divi site to clients who are not tech-savvy, as the sheer number of options and non-standard interface can be overwhelming compared to the native WordPress editor [1, 17].

Avoid if

Avoid Divi for projects where the end-user expects a simple, minimalist editing experience, as the learning curve is often described as steep and requires dedicated time to master [1].

Scout recommendation

Divi is best suited for agencies that can create a standardized workflow and training materials for their clients. The powerful Role Editor is a key feature for ensuring clients do not accidentally break complex layouts [11]. For simpler projects or clients who prefer the native WordPress experience, a block-based theme might be a better fit.

Alternatives: Kadence, GeneratePress, Bricks

Pricing

$89

Base price

Subscription Based

License type

$89/yr

Annual renewal

12 mo

Support included

Available plans

Plan	Price	Includes
Yearly Access	$89	All themes + plugins, unlimited sites, 1 year updates/support
Lifetime Access	$249	All themes + plugins, unlimited sites, lifetime updates/support
Divi Pro (Yearly)	$277	Divi Teams, Divi Cloud, Divi VIP support

Plugin Compatibility

3

Plugins tested

3

With issues

Plugin	Category	Status	Notes
WooCommerce	E-commerce	Partial support	Fully compatible for most use cases, but performance issues have been reported on large-scale sites, particularly when combined with WPML, leading to database bloat.
WPML	Multilingual	Partial support	The integration has historically caused performance problems on large sites. A recent WPML beta release is designed to improve compatibility with the upcoming Divi 5.
Advanced Custom Fields (ACF)	Content Management	Limited support	Divi does not natively support complex ACF field types like Repeaters or Flexible Content within its visual builder, requiring custom code or third-party solutions for integration.

Community Feedback

10 discussions analyzed

Timeframe Last 6 months

Analyzed Feb 2026

Pain points

Pattern of Authenticated Stored XSS vulnerabilities (historical — unconfirmed current) general

Show description

The most common attack vector involves a 'Contributor' or higher-level user injecting malicious scripts into the database through builder modules.

Common 60%

Minor Technical & Operational Analysis [1]
Divi 4.x struggles with mobile performance scores without aggressive optimization (unverified in v4.27.5) performance

Show description

Even with a good hosting and cache setup, it can't match the speed of Block editor or Bricks websites.

Common 60%

Moderate Reddit - Divi 4 Performance [6]
Large WooCommerce sites using WPML can suffer from extreme database bloat (unverified in v4.27.5) plugin compat

Show description

My database is now 3.5GB for 4k products... loading every attachment meta, like an image takes 0.2s each. 10 images adds 2s to load time.

Occasional 35%

Moderate WPML Support Forum [8]
Lacks native support for ACF Repeater and other complex field types (unverified in v4.27.5) general

Show description

Divi does not natively support ACF Repeater fields. For advanced field types, you need to use PHP inside a child theme or shortcode plugins.

Frequent 80%

Minor Developer Guide (ACF) [9]
WordPress core updates can introduce breaking style changes (historical — unconfirmed current) updates

Show description

Fixed all links having underlines coming from new styles released in WordPress 6.6.

Occasional 35%

Minor Divi Changelog [2]
Outdated jQuery Mobile library caused console errors after WordPress core updates (historical — unconfirmed current) updates

Show description

Upgraded jQuery Mobile from v1.4.5 to v1.5.0 alpha... Fixes console errors in Divi Block Editor.

Verified 25%

Minor Divi Changelog (jQuery) [10]
Static CSS caching mechanism can be "sticky," requiring manual clearing (unverified in v4.27.5) general

Show description

A common developer workaround for styling updates not reflecting on the front end is adding a shortcut to the admin bar specifically to clear Divi's local storage and static CSS cache.

Common 60%

Minor Pee-Aye Creative Guide [14]
Legacy shortcode architecture in Divi 4.x creates vendor lock-in (unverified in v4.27.5) general

Show description

The transition from Divi 4 to Divi 5 represents a 'paradigm shift' in performance... the removal of shortcodes in favor of a new HTML5-based framework

Frequent 80%

Moderate Technical & Operational Analysis [1]
Interface can be confusing for beginners and clients (historical — unconfirmed current) handoff

Show description

While beginners may find the interface's 'popups and icons' confusing, professional agencies have standardized training videos for clients

Common 60%

Minor Technical & Operational Analysis [1], Reddit - Learning Curve [17]
Historical XSS vulnerabilities required authenticated users (historical — unconfirmed current) (unverified in v4.27.5) general

Show description

Fixed a stored XSS vulnerability that made it possible for users with Contributor role or above to insert JavaScript code onto the page via the Divi Builder Gallery module's shortcode.

Occasional 35%

Moderate Divi Changelog (Security) [4]

Analysis based on user discussions in public forums, social media, and third-party reviews.

FAQ

: Yes, Divi can be considered secure. While there has been a pattern of authenticated stored XSS vulnerabilities, these typically require a malicious user to have at least 'Contributor' level access to the site [1]. The Elegant Themes development team has a strong track record of patching and disclosing vulnerabilities proactively and rapidly, often within days of a report [1, 4].
: The current version, Divi 4.x, is generally considered slower than modern builders like Bricks or block-based themes without aggressive caching and optimization [6]. However, the upcoming Divi 5 is a complete rewrite focused on performance, with early reports showing it is significantly faster and aims to be competitive with the fastest builders on the market [1, 5].
: Compatibility has been mixed. On large WooCommerce sites, the combination of Divi and WPML has historically led to performance issues and database bloat [8]. However, both development teams are actively working on improvements, and a recent WPML beta was released specifically to improve compatibility with the new architecture of Divi 5 [7].
: Not natively. The Divi Builder does not support ACF Repeater fields or other complex field types out of the box. To display this type of data, you will need to write custom PHP in a child theme or use a third-party plugin that bridges the gap [9].
: The primary difference is performance and architecture. Divi 4 is built on a legacy system of shortcodes, which can be slow and contribute to vendor lock-in. Divi 5 is a modern, HTML5-based framework that removes shortcodes entirely, resulting in dramatically faster page rendering and a more efficient build process [1, 5].
: Yes, Divi is an excellent choice for agencies due to its licensing model. The one-time Lifetime Access fee allows for use on unlimited websites, offering a significantly better long-term return on investment compared to the per-site or annual subscription models of competitors like Elementor [1, 12].
: The support team is widely praised as being industry-leading. Users report extremely fast response times, often within 15 minutes, available 24/7 via live chat, which is a major benefit for resolving critical issues quickly [13].
: Occasionally, major WordPress updates can cause minor cosmetic issues. For example, WordPress 6.6 introduced global styles that caused all links on Divi sites to become underlined. The Divi team addressed this with a patch in a subsequent theme update [2]. It is always recommended to test core updates on a staging site first.

Sources & Methodology

Data confidence: HIGH (17 analytical sources, 17 total)

[[1]] Technical & Operational Analysis — Official docs
[[2]] Divi Changelog — changelog
[[3]] WPScan Vulnerability DB — Official docs
[[4]] Divi Changelog (Security) — changelog
[[5]] Reddit - Divi 5 Performance — social
[[6]] Reddit - Divi 4 Performance — social
[[7]] WPML Changelog — changelog
[[8]] WPML Support Forum — forum
[[9]] Developer Guide (ACF) — documentation
[[10]] Divi Changelog (jQuery) — changelog
[[11]] Elegant Themes Documentation — documentation
[[12]] Reddit - Agency Model — social
[[13]] Reddit - Support Quality — social
[[14]] Pee-Aye Creative Guide — documentation
[[15]] Divi Changelog (Historical) — changelog
[[16]] Divi Changelog (Historical) — changelog
[[17]] Reddit - Learning Curve — social

Analysis date: February 7, 2026

Compare Divi with…

Side-by-side data comparisons against similar themes.