Description

Yatoon Social Feed lets you show your Facebook Page photos and Instagram Business account photos side by side (or separately) anywhere on your WordPress site, using a simple shortcode.

Instead of routing your login through a third-party server, this plugin connects directly with your own Meta app: you enter its App ID and App Secret once, click Connect, and the plugin exchanges the result for a long-lived token on your own server. Nothing passes through Yatoon, and no Meta App Review is needed for your own Page and account. If you prefer, you can still paste a token you generated yourself.

Features

Connect a Facebook Page with one click (“Connect with Facebook”): enter your own Meta app credentials once and the plugin obtains a long-lived Page token for you. Pasting a token manually is still possible
Connect an Instagram Business or Creator account with one click (“Connect with Instagram”); the plugin renews the token automatically before it expires
Instagram carousel posts (several photos or videos in one post) open as a slideshow in the lightbox
Posts you delete on Facebook or Instagram disappear from your feed on the next sync
Email and dashboard warnings when a connection needs attention (for example a token that cannot be renewed)
Automatic background sync (hourly, twice daily, or daily) – or sync manually with one click
Independent grid settings for Facebook and Instagram (columns, rows, spacing)
Optional profile header showing avatar, name, follower count, bio, and a Follow button – auto-synced from the connected accounts, no manual typing required
Simple shortcode: [yatoon_social_feed]
Responsive layouts, mobile columns, gallery/card/social-wall presets, live device preview, and an accessible lightbox
Local caching for synced Facebook and Instagram images, so temporary CDN URLs do not make the feed disappear
TikTok account sync via the official Login Kit + Display API, with curated links as a fallback
Privacy-first click-to-load official TikTok players; covers are cached locally during sync
Fully translatable, with a bundled .pot file
Lightweight: no Meta JavaScript SDKs loaded on your site

Pro Version

Pro adds caption keyword exclusion and a Custom CSS field, so you can curate the feed and match it to your site without a child theme. Upgrade to Pro.

Shortcode usage

[yatoon_social_feed]
[yatoon_social_feed platform="facebook"]
[yatoon_social_feed platform="instagram"]
[yatoon_social_feed platform="tiktok" columns="3"]
[yatoon_social_feed platform="facebook" columns="3" rows="2"]

External Services

This plugin connects to external APIs provided by Meta (Facebook/Instagram) to retrieve photos and profile information. These calls are made server-side from your WordPress installation – no Meta JavaScript SDK is loaded in visitors’ browsers.

Facebook Graph API and Facebook Login
Used to connect your account and to fetch your Facebook Page profile data (name, avatar, follower count, bio), photos, videos and posts. When you click “Connect with Facebook” your browser is sent to facebook.com to log in and approve access; your App ID, App Secret and the returned authorization code are then exchanged for tokens by your WordPress server. Data is also sent when you verify a token and during background sync.
– Service: Facebook / Meta Platforms, Inc.
– Endpoints: https://graph.facebook.com/ and https://www.facebook.com/ (login dialog)
– Terms of Service: https://developers.facebook.com/terms/
– Privacy Policy: https://www.facebook.com/privacy/policy/

Instagram API with Instagram Login
Used to connect your account and to fetch your Instagram profile data and media. When you click “Connect with Instagram” your browser is sent to instagram.com to log in and approve access; your Instagram app ID, app secret and the returned authorization code are then exchanged for tokens by your WordPress server. Tokens are renewed automatically. Data is also sent when you verify a token and during background sync.
– Service: Instagram / Meta Platforms, Inc.
– Endpoints: https://graph.instagram.com/, https://api.instagram.com/oauth/ and https://www.instagram.com/oauth/ (login dialog)
– Terms of Service: https://developers.facebook.com/terms/
– Privacy Policy: https://privacycenter.instagram.com/policy/

Facebook and Instagram media (video playback)
Facebook and Instagram video files are not copied to your server. When a visitor plays a video in the lightbox, their browser loads the file from Meta’s content delivery network (hosts such as *.fbcdn.net and *.cdninstagram.com), which makes the visitor’s IP address and browser details visible to Meta, as for any web resource.
– Service: Meta Platforms, Inc.
– Terms of Service: https://developers.facebook.com/terms/
– Privacy Policy: https://www.facebook.com/privacy/policy/

Freemius SDK (licensing and optional usage data)
The plugin includes the Freemius SDK to manage licensing and updates. With your consent in the opt-in screen, it sends basic site information (such as your site URL, WordPress and PHP versions, plugin version and your admin email address) to Freemius. If you skip the opt-in, only the data needed for licensing a paid plan is exchanged.
– Service: Freemius, Inc.
– Endpoints: https://api.freemius.com/ and https://wp.freemius.com/
– Terms of Service: https://freemius.com/terms/
– Privacy Policy: https://freemius.com/privacy/

TikTok Embed Player (optional)
Only when a visitor chooses to load a synced or curated TikTok video, their browser connects to TikTok to play it. Account syncing also sends the administrator’s saved app credentials and account token to TikTok’s OAuth and Display API endpoints from the WordPress server.
– Service: TikTok Pte. Ltd.
– Endpoints: https://open.tiktokapis.com/v2/oauth/ and https://open.tiktokapis.com/v2/video/; player: https://www.tiktok.com/player/
– Terms of Service: https://www.tiktok.com/legal/terms-of-service
– Privacy Policy: https://www.tiktok.com/legal/page/row/privacy-policy/en

This plugin does not collect or store visitor data. The only data transmitted to Meta’s APIs is your access token (to authenticate requests) and API query parameters (for example, requested fields and pagination limits).

Installation

Upload the plugin files to /wp-content/plugins/yatoon-social-feed, or install the plugin through the WordPress Plugins screen directly.
Activate the plugin through the ‘Plugins’ screen in WordPress.
Go to the Yatoon Social Feed menu item in your WordPress admin sidebar.
In your Meta app add the redirect URL shown in the plugin, then enter the App ID and App Secret under Facebook Page and click Save & Connect with Facebook. Do the same under Instagram Account if you use Instagram. For TikTok, create an approved Developer app with Login Kit and Display API, enter its client key/secret, save, then connect the account.
Approve the connection on Meta’s screen and, if you manage several Pages, pick the one to show.
The first sync starts automatically; use “Sync” any time to refresh manually.
Add the [yatoon_social_feed] shortcode to any page or post.

FAQ

Why does the frontend show old photos while the admin preview is current?: The preview reads saved posts without using the rendered-markup cache. A separate whole-page cache can still serve old HTML without running the plugin. Version 1.1.1 tags pages rendered by the feed and purges those LiteSpeed cache entries when the feed cache is invalidated. Update, open WordPress admin once, then sync. If an independent CDN or page-builder fragment cache is enabled, clear it separately too.
Do I need a Facebook Developer account?: You need a free Meta Developer account and your own Meta app, since Meta requires all API access to go through an App ID and App Secret. The settings screen lists the one-time setup steps (add the redirect URL, copy the App ID and Secret) and then connects with one click. Because the app is your own and you are its owner, you do not need to submit it for Meta’s App Review for your own Page and account.
How long do the tokens last?: A Facebook Page Access Token obtained from a long-lived User token, as described in our setup guide, normally has no scheduled expiry, although Meta can still revoke it (for example after a password change). An Instagram Access Token lasts about 60 days; the plugin renews it automatically once a day while it is valid, and you can also renew it manually from the settings screen. If a token ever stops working, the plugin shows a warning in the admin and emails the site administrator (you can turn the email off). Already synced photos stay on your site in the meantime.
How does TikTok automatic sync work?: TikTok requires your own approved Developer app. Add the exact HTTPS callback URL shown in the plugin, enable user.info.basic and video.list, save the client key/secret, and click Connect TikTok account. The plugin exchanges and refreshes tokens server-side, then retrieves the account’s public videos during the existing hourly, twice-daily, or daily WP-Cron sync. It does not publish videos to TikTok.
Does this plugin load Facebook’s, Instagram’s, or TikTok’s JavaScript on my site?: No Meta or TikTok player is loaded until a visitor explicitly clicks a video. Meta and TikTok API calls happen server-side from your WordPress installation; Facebook, Instagram and TikTok images are cached on your own server during sync. Facebook and Instagram video files are not downloaded: when a visitor plays one in the lightbox, their browser streams it directly from Meta’s content delivery network.
What data does this plugin store?: The plugin stores your Meta app credentials (App ID and secret), your Facebook/Instagram/TikTok access tokens and basic profile info in the WordPress options table, plus a local cache of synced post metadata. TikTok account tokens are kept server-side and are never sent to visitors. The plugin does not collect or store any visitor data. Playing a Facebook or Instagram video, or loading a TikTok player, connects the visitor’s browser to those services, as described under External Services.
Why does the plugin email me?: When a connection needs attention (for example an Instagram token that could not be renewed, or repeated sync failures) the plugin sends a short email to the site administrator address, at most once a week per platform. You can turn this off under Advanced sync settings.
What happens to my data if I delete the plugin?: If you delete the plugin (not just deactivate it) from the Plugins screen, all of its stored options and its database table are automatically removed.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Yatoon Social Feed” is open source software. The following people have contributed to this plugin.

Translate “Yatoon Social Feed” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.1.1

Fixed: syncing and saving settings now invalidate LiteSpeed full-page caches for pages containing a social feed, in addition to the plugin’s rendered-markup cache.
Improved: cache tags are added on shortcode cache hits, empty feeds and TikTok feeds too.
Upgrade: the first administrator request with LiteSpeed active clears its page cache once, so older pages without a feed tag can be rebuilt. Later invalidations target only feed-tagged pages.
Fixed: Pro features (caption keyword exclusion, Custom CSS) were not reliably gated. Pro code now ships only in the Pro package, and the free plugin contains no locked features.
New: Instagram tokens are renewed automatically every day before they expire, with a “Renew token now” button and the expiry date shown in the settings.
New: “Connect with Facebook” and “Connect with Instagram” buttons. Enter your Meta app credentials once; the plugin runs the login, obtains a long-lived token, lets you pick your Page and starts the first sync. App secrets and tokens stay on the server. Pasting a token by hand remains available under Advanced.
New: email and admin/dashboard warnings when a token cannot be renewed, has expired, or syncing keeps failing (can be turned off).
New: a warning (admin and email) when a connected feed has not synced for several days, even if no error was reported.
New: posts deleted on Facebook or Instagram are removed from your feed on the next sync. Nothing is removed when Meta returns an empty or partial response.
New: Instagram carousel posts show a multi-image icon and a slideshow in the lightbox.
New: Facebook link-share and text-only Page posts are now synced as well (previously only photo and video posts).
New: the Facebook “Page token” guide was rewritten to match Meta’s current flow.
Improved: rendered feeds are cached and refreshed automatically after every sync or settings change, reducing database queries on busy pages.
Fixed: lightbox buttons could be restyled into oversized shapes by some themes; they now keep a fixed neutral look.
Improved: a single malformed TikTok video no longer fails the whole TikTok sync.
Improved: cached images that are no longer used are cleaned up daily, and removed with the plugin on uninstall together with cached feed output.
Improved: every admin and front-end string is now translatable (text domain loaded, .pot file included).
Improved: the database schema is versioned and upgraded safely on update.
Improved: Pro Custom CSS is sanitized and printed after the plugin stylesheet; the admin sidebar override only applies when Yatoon’s booking plugin is active.
Improved: only five readme tags (WordPress.org limit) and updated External Services disclosures (Freemius SDK, Meta video CDN).

1.1.0

Added TikTok account OAuth connection and scheduled Display API sync with refresh-token rotation; curated links remain available as a fallback.
Added privacy-first official players and locally cached TikTok covers.
Redesigned the settings workflow with section navigation, visual presets, mobile preview, clearer save state, and a live preview that reflects more controls.
Added mobile column, corner-radius, media-type, and incremental “Load more” controls; Pro adds caption keyword exclusion.
Improved accessibility with semantic status messages, clear keyboard focus, lightbox next/previous navigation, Escape close, and focus restoration.
Cached Instagram images locally as well as Facebook images; validated downloaded image bytes and bounded sync cache time to protect server resources.
Hardened API responses, credential redaction in debug logs, atomic sync locking, and input bounds.
Removed all front-end Yatoon branding credits from both free and Pro editions.

1.0.6

Added video support for both Facebook and Instagram. Videos show in the grid as a poster image with a play icon and play inline in the lightbox on click; video files are streamed directly from Meta’s CDN rather than downloaded to your server.
Facebook Page tokens are now checked for their real expiry the moment you save them, so a short-lived token (easy to end up with if the “Extend Access Token” step gets skipped) is flagged immediately instead of silently breaking a few hours later. The Facebook card also now shows how long the current token has left.
Facebook/Instagram requests now retry once more if Meta reports an auth error (including “session expired”), since that specific error can be flaky for the same still-valid token rather than a true permanent failure – only a repeated failure is now treated as definitive.
Detects when a personal User Access Token was pasted into the Facebook Page Token field by mistake (a common Graph API Explorer mix-up) and shows exactly how to get the correct Page Access Token instead of a generic “invalid/expired” message.
Corrected the setup guide and plugin description, which incorrectly claimed a Page token from the standard Graph API Explorer flow never expires. In practice it lasts about 60 days and needs periodic renewal; a true never-expiring token requires a System User token from Meta Business Suite instead.

1.0.5

Added optional Masonry layout and popup lightbox for feed images.
Simplified the admin settings screen with clearer sync health cards and advanced settings collapsed by default.
Added simple layout controls while keeping detailed per-platform grid controls available under Advanced.
Fixed a packaging issue that could cause “headers already sent” warnings on some hosts.
Extended the existing Freemius after_uninstall cleanup to also remove cached images, so nothing is left behind when the plugin is deleted.
Reduced redundant Facebook profile API calls during sync to lower the chance of hitting Meta rate limits.
Hardened Instagram sync against occasional malformed/partial API responses.
Added proactive admin warnings when a Facebook or Instagram token looks expired, instead of only surfacing errors after the fact.
Added a simple sync lock so manual “Sync now” clicks and the scheduled auto-sync can never run concurrently.
Validated the platform shortcode attribute against a known list instead of silently rendering an empty grid on a typo.
Moved Live Preview next to Step 3’s Display Settings and made it update instantly as you change layout, display mode, lightbox, link, gap, or Custom CSS – no need to save first.
Widened the settings page and gave Live Preview more room, with compact profile-header styling so it doesn’t look cramped in the sidebar.
Added the missing Columns/Rows fields for the combined feed (previously only saved via a stray shortcode attribute) and made Live Preview mirror them exactly, so what you see matches what visitors actually get.
Live Preview now scrolls both directions instead of squashing thumbnails, so it stays legible even with large grids like 6 columns x 6 rows.
Removed the old empty placeholder “Facebook/Instagram Grid Preview” boxes under Advanced grid controls – the real photo-based Live Preview made them redundant.
Fixed a bug where a temporary network/rate-limit hiccup during sync was misreported as “token expired.” Sync now retries once automatically on a transient failure, and only shows a “regenerate your token” message when Meta’s response unambiguously confirms the token itself is invalid.
Pro: added a Custom CSS field (Display Settings) to fine-tune colors, spacing, and fonts without a child theme.

1.0.4

Added next auto-sync time and last auto-sync status to the settings screen.
Added separate last-error diagnostics for Facebook and Instagram sync.
Reschedule WP-Cron immediately when the auto-sync frequency changes.
Improved Instagram API error reporting so failed requests are visible instead of looking like empty syncs.

1.0.3

Updated Freemius SDK to 2.13.4.
Split Facebook Page token and Instagram token setup into independent Step 1A / Step 1B flows.
Facebook token removal no longer removes Instagram settings, and Instagram removal no longer touches Facebook settings.
Added display modes for images only, text only, or images plus text/captions.
Improved Facebook sync refresh and error handling so valid saved Page tokens are rechecked before sync.
Moved Facebook and Instagram sync actions to one primary button per token section.
Changed the admin menu page slug to avoid being captured by Yatoon Booking’s admin shell.

1.0.2

Updated Meta Graph API endpoints from v19.0 to v25.0.
Improved Facebook photo sync fallback when the full images array is unavailable.
Facebook photos are now cached locally during sync to prevent expired Meta CDN URLs from breaking the front-end grid.
Added a configurable Meta API version setting for future Graph API version changes.

1.0.1

Added optional Pro upgrade.
Fixed Plugin URI to a valid URL.
Bumped stable tag to match plugin version.

1.0.0

Initial public release.
Facebook Page photo sync via permanent Page Access Token.
Instagram Business photo sync via Instagram Access Token.
Independent grid layout settings per platform.
Auto-synced profile header (avatar, name, followers, bio, follow button).
Scheduled background sync with manual sync option.

Description

Pro Version

External Services

Installation

FAQ

Why does the frontend show old photos while the admin preview is current?

Do I need a Facebook Developer account?

How long do the tokens last?

How does TikTok automatic sync work?

Does this plugin load Facebook’s, Instagram’s, or TikTok’s JavaScript on my site?

What data does this plugin store?

Why does the plugin email me?

What happens to my data if I delete the plugin?