Title: Instaflax Social Feed Author: ballu26 Published: July 28, 2026 Last modified: July 28, 2026 --- Search plugins ![](https://ps.w.org/instaflax-social-feed/assets/banner-772x250.png?rev=3625814) ![](https://ps.w.org/instaflax-social-feed/assets/icon-256x256.png?rev=3625814) # Instaflax Social Feed By [ballu26](https://profiles.wordpress.org/ballu26/) [Download](https://downloads.wordpress.org/plugin/instaflax-social-feed.1.3.9.zip) * [Details](https://vec.wordpress.org/plugins/instaflax-social-feed/#description) * [Reviews](https://vec.wordpress.org/plugins/instaflax-social-feed/#reviews) * [Installation](https://vec.wordpress.org/plugins/instaflax-social-feed/#installation) * [Development](https://vec.wordpress.org/plugins/instaflax-social-feed/#developers) [Support](https://wordpress.org/support/plugin/instaflax-social-feed/) ## Description **Instaflax Social Feed** lets you show your Instagram content on any WordPress page using the official Instagram Graph API. Connect your account securely via OAuth, design your feed with a live Feed Customizer, and embed it anywhere with a simple shortcode. #### Key Features * **Instagram OAuth** — connect your profile securely from the plugin dashboard * **Multiple feeds** — create and manage separate feeds for different pages * **Feed Customizer** — Grid and Carousel layouts with live preview * **Responsive** — separate column and post counts for desktop, tablet, and mobile * **Profile header** — profile name and bio options * **Click actions** — open Instagram link or disable click * **Smart caching** — reduce API calls with configurable cache duration * **Automatic token refresh** — background refresh keeps your feed running * **Encrypted token storage** — access tokens are AES-256 encrypted in the database * **Connect requirements** — Getting Started shows Professional Instagram account requirements before OAuth * **Website confirmation** — after Instagram authorization, confirm your site domain before the account is saved #### Shortcodes Only `[instaflax_feed]` is the recommended shortcode. Prefixed legacy aliases `[ instaflax_insta_feed]` and `[instaflax_inf_instagram_feed]` are available for sites migrating from older shortcodes. Display a saved feed: ``` [instaflax_feed id="1"] ``` Replace `1` with your feed ID shown in the All Feeds list. Prefixed legacy shortcodes: ``` [instaflax_insta_feed id="1"] ``` Attribute override shortcode: ``` [instaflax_feed id="1" posts="6" columns="3" caption="true" layout="grid"] [instaflax_inf_instagram_feed] is a prefixed legacy alias for backward compatibility. ``` #### Requirements * Instagram Professional account (Business or Creator); personal accounts are not supported * Outbound HTTPS access from your WordPress site to Instagram and the Instaflax OAuth proxy (one.mahihub.in) * After install, visit **Settings Permalinks** once and click **Save** so `/instagram- proxy-callback/` works on your site * For typical WordPress.org installs, you do **not** need your own Meta developer app or to register your site URL in Meta — Connect uses the Instaflax hosted OAuth proxy * Optional (advanced / self-hosted Meta app): set your Instagram App ID in `includes/ instaflax-instagram-oauth-config.php` or `define( 'INSTAFLAX_INSTAGRAM_APP_ID',' YOUR_ID' );` in `wp-config.php`, and add `https://yoursite.com/instagram-proxy- callback/` to your Meta app Valid OAuth Redirect URIs #### External Services This plugin connects to the following third-party services. By using this plugin, you agree to their respective terms and privacy policies. **Instagram** (instagram.com / graph.instagram.com) Used during OAuth authorization( instagram.com) and, after your account is connected, to fetch your Instagram profile, posts, and to refresh your long-lived access token (graph.instagram.com). During Connect, your browser is sent to Instagram through the Instaflax OAuth proxy; after you approve access, an authorization code is relayed to your site at `/instagram- proxy-callback/`. After connection, your long-lived access token is stored encrypted in your WordPress database and sent to the Instagram Graph API when the plugin fetches or refreshes feed data. [Instagram Terms of Use](https://help.instagram.com/581066165581870) | [Meta Privacy Policy](https://privacycenter.instagram.com/policy) **OAuth Proxy** (one.mahihub.in) Used for the Instagram connection flow and token exchange. When you click **Connect Instagram**, your browser is sent to the proxy authorize endpoint (`/ig-proxy/authorize.php`) with your site callback URL (`return_to`). The proxy redirects you to Instagram using a single fixed OAuth callback on the proxy (`/ig-proxy/oauth-callback.php`) so you do not need to register your domain in Meta. After you approve access, Instagram returns to the proxy, which relays the authorization code to your site at `/instagram-proxy-callback/`; the plugin then sends the code to the proxy (`/ig-proxy/index.php`) to obtain short-lived and long-lived access tokens. The App Secret is never stored in the WordPress plugin. Legal terms and privacy for this service are published by Instaflax at the links below. [Terms of Service](https://www.instaflax.com/terms) | [Privacy Policy](https://www.instaflax.com/privacy-policy) ## Installation 1. Upload the `instaflax-social-feed` folder to `/wp-content/plugins/`, or install via **Plugins Add New**. **Legacy entry-point files:** Older releases used different main plugin filenames(` instaflax-instagram-feed.php`, `social-connect-feed.php`). Those two files remain in the plugin root as thin loaders that only `require` `instaflax-social-feed.php`, so existing activations keep working after upgrade. They are not duplicate plugins— WordPress lists a single plugin, **Instaflax Social Feed**. 1. Activate **Instaflax Social Feed** from the Plugins screen. 2. Go to **Settings Permalinks** and click **Save** once (registers `/instagram-proxy- callback/` on your site). 3. Go to **Instaflax** in the WordPress admin menu. 4. On the Dashboard, click **Link Account**, review **Before you connect**, then click** Connect Instagram** and complete Instagram login and approval. 5. Confirm your website when prompted on the Dashboard. 6. Create a feed under **All Feeds**, customize it, and paste `[instaflax_feed id=" X"]` on any page. **Advanced (optional):** If you use your own Meta developer app instead of the default hosted OAuth flow, set your Instagram App ID in `includes/instaflax-instagram-oauth- config.php` or add `define( 'INSTAFLAX_INSTAGRAM_APP_ID', 'YOUR_ID' );` to `wp-config. php`, and add `https://your-domain.com/instagram-proxy-callback/` to your Meta app Valid OAuth Redirect URIs. ## FAQ ### What happens to my data if I delete the plugin? When you delete Instaflax Social Feed from the Plugins screen (not just deactivate), WordPress runs the plugin uninstall routine. All plugin data is removed from your database, including saved feed settings, cached Instagram media, connected-account records, and AES-encrypted access tokens. ### Do I need a Meta developer app? For typical WordPress.org installs, **no**. Connect uses the Instaflax hosted OAuth proxy; you do not enter an App ID in the plugin. You need a Professional Instagram account and a working callback URL on your site (`/instagram-proxy-callback/`). Advanced users who run their own Meta app may set `INSTAFLAX_INSTAGRAM_APP_ID` in` wp-config.php` or `instagram_app_id` in `includes/instaflax-instagram-oauth-config. php`. ### Why does Connect open Settings with “Instagram connect is unavailable”? The plugin could not build an OAuth URL. Common causes: the hosted proxy authorize endpoint is unreachable, your site cannot reach `one.mahihub.in`, or (for advanced self-hosted setups) no valid Instagram App ID is configured. Ensure the proxy `authorize. php` is deployed and your site can use HTTPS outbound requests. Re-save **Settings Permalinks** before trying again. ### Why do I get a 404 on one.mahihub.in/ig-proxy/authorize.php? That URL is served by the Instaflax OAuth proxy, not your WordPress site. A WordPress- themed 404 usually means `authorize.php` is missing from the proxy server. The proxy operator must deploy the `ig-proxy` folder files (`authorize.php`, `oauth-callback. php`, and `index.php`). After they are deployed, **Connect Instagram** should redirect to Instagram login instead of a 404 page. ### Why does Instagram show “Invalid redirect_uri”? For typical installs using the hosted OAuth proxy, only the proxy callback URL must be registered in the Meta app (`https://one.mahihub.in/ig-proxy/oauth-callback.php`), not each customer site. If you see this error, the proxy operator needs `authorize. php` and `oauth-callback.php` deployed on one.mahihub.in and that single callback URL registered in the Meta app. Advanced self-hosted Meta app users must add their own site callback to their Meta app instead. ### Why do I see “Invalid or expired OAuth state” on one.mahihub.in after allowing Instagram access? That page is the Instaflax OAuth proxy callback. This error usually means Connect did not start through the proxy authorize URL (`/ig-proxy/authorize.php`), so the signed relay state was missing. Update to Instaflax Social Feed 1.3.8 or later and try Connect again from the plugin Dashboard. ### Why does OAuth return a 404 after connecting on my site? Go to **Settings Permalinks** and click **Save Changes** — this registers the `/ instagram-proxy-callback/` rewrite rule that WordPress needs. ### What type of Instagram account do I need? You need a Professional Instagram account (Business or Creator). Personal accounts are not supported. See [Instaflax Help](https://www.instaflax.com/help) for setup guidance. ### Why am I asked to confirm my website after connecting? After you approve access on Instagram, the plugin asks you to confirm that this WordPress site is the correct place to connect your account. This helps ensure your feed is linked to the right website. ### Are premium features locked in this WordPress.org build? No. The WordPress.org build does not lock built-in functionality behind license checks. ### What is the difference between [instaflax_feed] and legacy shortcodes? [instaflax_feed id=”X”] is the recommended shortcode. Prefixed legacy aliases: `[ instaflax_insta_feed id="X"]` (replaces removed `[insta-feed]`) and `[instaflax_inf_instagram_feed]`( replaces removed `[inf_instagram_feed]`). ### Is my Instagram access token stored securely? Yes. Tokens are encrypted with AES-256-CBC before being saved to the database, using keys derived from your WordPress secret keys. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Instaflax Social Feed” is open source software. The following people have contributed to this plugin. Contributors * [ ballu26 ](https://profiles.wordpress.org/ballu26/) [Translate “Instaflax Social Feed” into your language.](https://translate.wordpress.org/projects/wp-plugins/instaflax-social-feed) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/instaflax-social-feed/), check out the [SVN repository](https://plugins.svn.wordpress.org/instaflax-social-feed/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/instaflax-social-feed/) by [RSS](https://plugins.trac.wordpress.org/log/instaflax-social-feed/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.3.9 * Removed the 20-post and plan-style column limits so feed display settings match built-in capabilities * Removed locked Pro-only cache duration UI; Settings shows the available 24-hour cache option only * WordPress.org Guideline 5 (trialware) compliance for posts, columns, and cache controls #### 1.3.8 * OAuth: hosted proxy flow now uses a single fixed Meta redirect URI on one.mahihub. in so any WordPress site can connect without registering its domain in Meta * OAuth: authorize proxy requests pass `return_to` (site callback) instead of per- site Meta redirect URIs * OAuth: always route Connect through the hosted authorize proxy so relay state is signed (fixes “Invalid or expired OAuth state” after Instagram approval) #### 1.3.7 * Security: admin actions now verify nonce and capability before reading POST/GET input (delete feed, disconnect account, remove connected account, bulk delete) * Security: OAuth callbacks verify the `state` CSRF nonce before processing the authorization `code` * Security: legacy admin slug redirects use an allowlisted query-arg passthrough instead of bulk `$_GET` forwarding #### 1.3.6 * Removed admin UI restrictions that blocked creating a 3rd feed and connecting additional Instagram accounts while backend support was already unlimited * Aligns the free WordPress.org build with plugin directory guidelines (no UI-level trialware for built-in feed and account features) #### 1.3.5 * OAuth connect uses the Instaflax hosted proxy authorize URL by default (no manual App ID entry for typical installs) * Improved OAuth authorize URL resolution: use configured App ID when present, otherwise proxy authorize * Removed the developer-only OAuth configuration admin notice from Instaflax admin screens * Readme: updated installation, requirements, External Services, and troubleshooting for proxy-based connect #### 1.3.4 * Plugin Check / PHPCS: resolved all nonce and input sanitization warnings in admin settings POST handling and read-only admin GET helpers (no behavior change) * Plugin Check: corrected phpcs disable/enable scope for the remaining 9 nonce warnings * Plugin Check: uninstall.php prefix and WordPress 6.0 compatibility fixes (object cache group flush guarded for WP 6.1+) #### 1.3.3 * Fixed deleted or missing feed shortcodes (e.g. `[instaflax_feed id="103"]`) still showing Instagram posts from the first connected account * Admins now see a “Feed not found.” notice for invalid feed ids; public visitors see no output #### 1.3.2 * Free build cleanup: removed non-functional Pro feature code (follow button, custom bio, lightbox, custom colors, rounded corners, sort oldest, image resolution settings) * Marketing upsell UI retained for Pro features; functional code will ship in the separate Pro plugin #### 1.3.1 * Fixed Instagram token refresh to decrypt AES-encrypted tokens before calling the refresh API * Security improvements: nonce verification order, input sanitization, and wp_safe_redirect for admin and OAuth flows * Fixed admin redirect loop on All Feeds and Settings pages * Removed non-prefixed legacy shortcodes and generic SOCIAL_CONNECT_FEED_* constants for WordPress.org namespace compliance * Free build cleanup: removed Masonry, Highlight layout, and Carousel Autoplay code from customizer and frontend * Plugin Check compliance: Tested up to WordPress 7.0, languages folder silencer, release zip excludes hidden and dev files * Improved admin query argument handling and feed template coding standards #### 1.3.0 * Renamed all plugin prefixes from inf_ to instaflax_ for WordPress.org namespace compliance * Renamed asset handles, CSS classes, and JS identifiers from inf- to instaflax- * Primary shortcode is [instaflax_feed]; prefixed legacy aliases [instaflax_insta_feed] and [instaflax_inf_instagram_feed] replace non-prefixed [insta-feed] and [inf_instagram_feed] * Removed non-prefixed SOCIAL_CONNECT_FEED_* constants and social_connect_feed_* wrappers for WordPress.org compliance * Added automatic migration from inf_* options to instaflax_* on plugin update * Getting Started Link Account opens a “Before you connect” requirements screen( Professional account + Instagram authorization) * After OAuth, confirm your website domain before the account is saved * Improved dashboard connect loading and confirmation dialogs * Fixed dashboard “last synced” display when feed cache was stale * Clearer admin confirmation buttons for delete and disconnect actions #### 1.2.0 * Renamed plugin to Instaflax Social Feed for WordPress.org compliance * Removed local feature locks from runtime behavior to align with WordPress.org policy * Prefixed wp_options keys to avoid collisions (inf_*) * Replaced inline script/style with WordPress enqueue APIs * Plugin URI and documentation updated to instaflax.com #### 1.1.1 * License management integrated into Settings page * Token storage upgraded to AES-256 encryption #### 1.1.0 * Multiple saved feeds and Feed Customizer * Multiple Instagram account support * OAuth proxy callback route and encrypted token storage * Feed import/export #### 1.0.0 * Initial release ## Meta * Version **1.3.9** * Last updated **2 weeks ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.0.3** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/instaflax-social-feed/) * Tags * [gallery](https://vec.wordpress.org/plugins/tags/gallery/)[Instagram](https://vec.wordpress.org/plugins/tags/instagram/) [instagram feed](https://vec.wordpress.org/plugins/tags/instagram-feed/)[shortcode](https://vec.wordpress.org/plugins/tags/shortcode/) [social media](https://vec.wordpress.org/plugins/tags/social-media/) * [Advanced View](https://vec.wordpress.org/plugins/instaflax-social-feed/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/instaflax-social-feed/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/instaflax-social-feed/reviews/) ## Contributors * [ ballu26 ](https://profiles.wordpress.org/ballu26/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/instaflax-social-feed/)