Yatoon Social Feed

by yatoon

Description

Yatoon Social Feed lets you show your Facebook Page photos and Instagram Business account photos side by side (or separately) anywhere on your WordPress site, using a simple shortcode.

Instead of a fragile one-click OAuth login (which frequently breaks as Meta changes its app review requirements), this plugin uses long-lived access tokens that you generate once via Meta’s own tools and paste into the settings screen. This keeps the plugin lightweight and avoids requiring you to create and maintain your own Meta Developer App with special review permissions for basic photo display.

Features

Connect a Facebook Page using a permanent Page Access Token
Connect an Instagram Business account using an Instagram Access Token; the plugin renews the token automatically before it expires
Instagram carousel posts (several photos or videos in one post) open as a slideshow in the lightbox
Posts you delete on Facebook or Instagram disappear from your feed on the next sync
Email and dashboard warnings when a connection needs attention (for example a token that cannot be renewed)
Automatic background sync (hourly, twice daily, or daily) – or sync manually with one click
Independent grid settings for Facebook and Instagram (columns, rows, spacing)
Optional profile header showing avatar, name, follower count, bio, and a Follow button – auto-synced from the connected accounts, no manual typing required
Simple shortcode: [yatoon_social_feed]
Responsive layouts, mobile columns, gallery/card/social-wall presets, live device preview, and an accessible lightbox
Local caching for synced Facebook and Instagram images, so temporary CDN URLs do not make the feed disappear
TikTok account sync via the official Login Kit + Display API, with curated links as a fallback
Privacy-first click-to-load official TikTok players; covers are cached locally during sync
Fully translatable, with a bundled .pot file
Lightweight: no Meta JavaScript SDKs loaded on your site

Pro Version

Pro adds caption keyword exclusion and a Custom CSS field, so you can curate the feed and match it to your site without a child theme. Upgrade to Pro.

Shortcode usage

[yatoon_social_feed]
[yatoon_social_feed platform="facebook"]
[yatoon_social_feed platform="instagram"]
[yatoon_social_feed platform="tiktok" columns="3"]
[yatoon_social_feed platform="facebook" columns="3" rows="2"]

External Services

This plugin connects to external APIs provided by Meta (Facebook/Instagram) to retrieve photos and profile information. These calls are made server-side from your WordPress installation – no Meta JavaScript SDK is loaded in visitors’ browsers.

Facebook Graph API
Used to fetch your Facebook Page profile data (name, avatar, follower count, bio) and Page photos. Data is sent when you verify your token and during background sync.
– Service: Facebook / Meta Platforms, Inc.
– Endpoint: https://graph.facebook.com/
– Terms of Service: https://developers.facebook.com/terms/
– Privacy Policy: https://www.facebook.com/privacy/policy/

Instagram Graph API
Used to fetch your Instagram Business account profile data and media. Data is sent when you verify your token and during background sync.
– Service: Instagram / Meta Platforms, Inc.
– Endpoint: https://graph.instagram.com/
– Terms of Service: https://developers.facebook.com/terms/
– Privacy Policy: https://privacycenter.instagram.com/policy/

Facebook and Instagram media (video playback)
Facebook and Instagram video files are not copied to your server. When a visitor plays a video in the lightbox, their browser loads the file from Meta’s content delivery network (hosts such as *.fbcdn.net and *.cdninstagram.com), which makes the visitor’s IP address and browser details visible to Meta, as for any web resource.
– Service: Meta Platforms, Inc.
– Terms of Service: https://developers.facebook.com/terms/
– Privacy Policy: https://www.facebook.com/privacy/policy/

Freemius SDK (licensing and optional usage data)
The plugin includes the Freemius SDK to manage licensing and updates. With your consent in the opt-in screen, it sends basic site information (such as your site URL, WordPress and PHP versions, plugin version and your admin email address) to Freemius. If you skip the opt-in, only the data needed for licensing a paid plan is exchanged.
– Service: Freemius, Inc.
– Endpoints: https://api.freemius.com/ and https://wp.freemius.com/
– Terms of Service: https://freemius.com/terms/
– Privacy Policy: https://freemius.com/privacy/

TikTok Embed Player (optional)
Only when a visitor chooses to load a synced or curated TikTok video, their browser connects to TikTok to play it. Account syncing also sends the administrator’s saved app credentials and account token to TikTok’s OAuth and Display API endpoints from the WordPress server.
– Service: TikTok Pte. Ltd.
– Endpoints: https://open.tiktokapis.com/v2/oauth/ and https://open.tiktokapis.com/v2/video/; player: https://www.tiktok.com/player/
– Terms of Service: https://www.tiktok.com/legal/terms-of-service
– Privacy Policy: https://www.tiktok.com/legal/page/row/privacy-policy/en

This plugin does not collect or store visitor data. The only data transmitted to Meta’s APIs is your access token (to authenticate requests) and API query parameters (for example, requested fields and pagination limits).

Installation

Upload the plugin files to /wp-content/plugins/yatoon-social-feed, or install the plugin through the WordPress Plugins screen directly.
Activate the plugin through the ‘Plugins’ screen in WordPress.
Go to the Yatoon Social Feed menu item in your WordPress admin sidebar.
Follow the in-plugin setup guide to connect Facebook and (optionally) Instagram. For TikTok, create an approved Developer app with Login Kit and Display API, enter its client key/secret, save, then connect the account.
Paste the token(s) and click Verify & Save.
Click “Sync” to pull in your first batch of photos.
Add the [yatoon_social_feed] shortcode to any page or post.

Faq

Do I need a Facebook Developer account?

You need a free Meta Developer account to generate the access tokens this plugin uses, since Meta requires all third-party API access to go through an App ID and App Secret. The in-plugin setup guide walks you through this step by step. You do not need to submit your app for Meta’s App Review for basic Page photo access – that’s only required for advanced permissions.

How long do the tokens last?

A Facebook Page Access Token obtained from a long-lived User token, as described in our setup guide, normally has no scheduled expiry, although Meta can still revoke it (for example after a password change). An Instagram Access Token lasts about 60 days; the plugin renews it automatically once a day while it is valid, and you can also renew it manually from the settings screen. If a token ever stops working, the plugin shows a warning in the admin and emails the site administrator (you can turn the email off). Already synced photos stay on your site in the meantime.

How does TikTok automatic sync work?

TikTok requires your own approved Developer app. Add the exact HTTPS callback URL shown in the plugin, enable user.info.basic and video.list, save the client key/secret, and click Connect TikTok account. The plugin exchanges and refreshes tokens server-side, then retrieves the account’s public videos during the existing hourly, twice-daily, or daily WP-Cron sync. It does not publish videos to TikTok.

Does this plugin load Facebook’s, Instagram’s, or TikTok’s JavaScript on my site?

No Meta or TikTok player is loaded until a visitor explicitly clicks a video. Meta and TikTok API calls happen server-side from your WordPress installation; Facebook, Instagram and TikTok images are cached on your own server during sync. Facebook and Instagram video files are not downloaded: when a visitor plays one in the lightbox, their browser streams it directly from Meta’s content delivery network.

What data does this plugin store?

The plugin stores your Facebook/Instagram/TikTok access tokens and basic profile info in the WordPress options table, plus a local cache of synced post metadata. TikTok account tokens are kept server-side and are never sent to visitors. The plugin does not collect or store any visitor data. Playing a Facebook or Instagram video, or loading a TikTok player, connects the visitor’s browser to those services, as described under External Services.

Why does the plugin email me?

When a connection needs attention (for example an Instagram token that could not be renewed, or repeated sync failures) the plugin sends a short email to the site administrator address, at most once a week per platform. You can turn this off under Advanced sync settings.

What happens to my data if I delete the plugin?

If you delete the plugin (not just deactivate it) from the Plugins screen, all of its stored options and its database table are automatically removed.

Reviews

Changelog

1.1.1

Fixed: Pro features (caption keyword exclusion, Custom CSS) were not reliably gated. Pro code now ships only in the Pro package, and the free plugin contains no locked features.
New: Instagram tokens are renewed automatically every day before they expire, with a “Renew token now” button and the expiry date shown in the settings.
New: email and admin/dashboard warnings when a token cannot be renewed, has expired, or syncing keeps failing (can be turned off).
New: posts deleted on Facebook or Instagram are removed from your feed on the next sync. Nothing is removed when Meta returns an empty or partial response.
New: Instagram carousel posts show a multi-image icon and a slideshow in the lightbox.
New: Facebook link-share and text-only Page posts are now synced as well (previously only photo and video posts).
New: the Facebook “Page token” guide was rewritten to match Meta’s current flow.
Improved: rendered feeds are cached and refreshed automatically after every sync or settings change, reducing database queries on busy pages.
Improved: a single malformed TikTok video no longer fails the whole TikTok sync.
Improved: cached images that are no longer used are cleaned up daily, and removed with the plugin on uninstall together with cached feed output.
Improved: every admin and front-end string is now translatable (text domain loaded, .pot file included).
Improved: the database schema is versioned and upgraded safely on update.
Improved: Pro Custom CSS is sanitized and printed after the plugin stylesheet; the admin sidebar override only applies when Yatoon’s booking plugin is active.
Improved: only five readme tags (WordPress.org limit) and updated External Services disclosures (Freemius SDK, Meta video CDN).

1.1.0

Added TikTok account OAuth connection and scheduled Display API sync with refresh-token rotation; curated links remain available as a fallback.
Added privacy-first official players and locally cached TikTok covers.
Redesigned the settings workflow with section navigation, visual presets, mobile preview, clearer save state, and a live preview that reflects more controls.
Added mobile column, corner-radius, media-type, and incremental “Load more” controls; Pro adds caption keyword exclusion.
Improved accessibility with semantic status messages, clear keyboard focus, lightbox next/previous navigation, Escape close, and focus restoration.
Cached Instagram images locally as well as Facebook images; validated downloaded image bytes and bounded sync cache time to protect server resources.
Hardened API responses, credential redaction in debug logs, atomic sync locking, and input bounds.
Removed all front-end Yatoon branding credits from both free and Pro editions.

1.0.6

Added video support for both Facebook and Instagram. Videos show in the grid as a poster image with a play icon and play inline in the lightbox on click; video files are streamed directly from Meta’s CDN rather than downloaded to your server.
Facebook Page tokens are now checked for their real expiry the moment you save them, so a short-lived token (easy to end up with if the “Extend Access Token” step gets skipped) is flagged immediately instead of silently breaking a few hours later. The Facebook card also now shows how long the current token has left.
Facebook/Instagram requests now retry once more if Meta reports an auth error (including “session expired”), since that specific error can be flaky for the same still-valid token rather than a true permanent failure – only a repeated failure is now treated as definitive.
Detects when a personal User Access Token was pasted into the Facebook Page Token field by mistake (a common Graph API Explorer mix-up) and shows exactly how to get the correct Page Access Token instead of a generic “invalid/expired” message.
Corrected the setup guide and plugin description, which incorrectly claimed a Page token from the standard Graph API Explorer flow never expires. In practice it lasts about 60 days and needs periodic renewal; a true never-expiring token requires a System User token from Meta Business Suite instead.

1.0.5

Added optional Masonry layout and popup lightbox for feed images.
Simplified the admin settings screen with clearer sync health cards and advanced settings collapsed by default.
Added simple layout controls while keeping detailed per-platform grid controls available under Advanced.
Fixed a packaging issue that could cause “headers already sent” warnings on some hosts.
Extended the existing Freemius after_uninstall cleanup to also remove cached images, so nothing is left behind when the plugin is deleted.
Reduced redundant Facebook profile API calls during sync to lower the chance of hitting Meta rate limits.
Hardened Instagram sync against occasional malformed/partial API responses.
Added proactive admin warnings when a Facebook or Instagram token looks expired, instead of only surfacing errors after the fact.
Added a simple sync lock so manual “Sync now” clicks and the scheduled auto-sync can never run concurrently.
Validated the platform shortcode attribute against a known list instead of silently rendering an empty grid on a typo.
Moved Live Preview next to Step 3’s Display Settings and made it update instantly as you change layout, display mode, lightbox, link, gap, or Custom CSS – no need to save first.
Widened the settings page and gave Live Preview more room, with compact profile-header styling so it doesn’t look cramped in the sidebar.
Added the missing Columns/Rows fields for the combined feed (previously only saved via a stray shortcode attribute) and made Live Preview mirror them exactly, so what you see matches what visitors actually get.
Live Preview now scrolls both directions instead of squashing thumbnails, so it stays legible even with large grids like 6 columns x 6 rows.
Removed the old empty placeholder “Facebook/Instagram Grid Preview” boxes under Advanced grid controls – the real photo-based Live Preview made them redundant.
Fixed a bug where a temporary network/rate-limit hiccup during sync was misreported as “token expired.” Sync now retries once automatically on a transient failure, and only shows a “regenerate your token” message when Meta’s response unambiguously confirms the token itself is invalid.
Pro: added a Custom CSS field (Display Settings) to fine-tune colors, spacing, and fonts without a child theme.

1.0.4

Added next auto-sync time and last auto-sync status to the settings screen.
Added separate last-error diagnostics for Facebook and Instagram sync.
Reschedule WP-Cron immediately when the auto-sync frequency changes.
Improved Instagram API error reporting so failed requests are visible instead of looking like empty syncs.

1.0.3

Updated Freemius SDK to 2.13.4.
Split Facebook Page token and Instagram token setup into independent Step 1A / Step 1B flows.
Facebook token removal no longer removes Instagram settings, and Instagram removal no longer touches Facebook settings.
Added display modes for images only, text only, or images plus text/captions.
Improved Facebook sync refresh and error handling so valid saved Page tokens are rechecked before sync.
Moved Facebook and Instagram sync actions to one primary button per token section.
Changed the admin menu page slug to avoid being captured by Yatoon Booking’s admin shell.

1.0.2

Updated Meta Graph API endpoints from v19.0 to v25.0.
Improved Facebook photo sync fallback when the full images array is unavailable.
Facebook photos are now cached locally during sync to prevent expired Meta CDN URLs from breaking the front-end grid.
Added a configurable Meta API version setting for future Graph API version changes.

1.0.1

Added optional Pro upgrade.
Fixed Plugin URI to a valid URL.
Bumped stable tag to match plugin version.

1.0.0

Initial public release.
Facebook Page photo sync via permanent Page Access Token.
Instagram Business photo sync via Instagram Access Token.
Independent grid layout settings per platform.
Auto-synced profile header (avatar, name, followers, bio, follow button).
Scheduled background sync with manual sync option.