Vemoro SocialFeed

Vemoro SocialFeed uses Meta’s official Instagram API with Instagram Login. It stores required content in WordPress so ordinary frontend views do not need Meta scripts, embeds, API calls, or CDN media. The recommended Vemoro Login does not require a Meta App Secret in WordPress; an own Meta app remains available as expert mode.

The recommended login uses the external Vemoro connection service at connect.vemoro.de. When the administrator deliberately starts a connection, WordPress transmits the WordPress callback URL, a random security state, plugin version and site URL to that service. The service communicates with Instagram, keeps an OAuth flow for at most ten minutes and an encrypted one-time grant for at most two minutes. It does not retain the permanent Instagram token. Service privacy information: https://vemoro.de/socialfeed/datenschutz/ . Terms: https://vemoro.de/nutzungsbedingungen/ . Data deletion instructions: https://vemoro.de/datenloeschung/ .

Visitors do not connect to Meta on ordinary page views. Only the website operator’s server communicates with the Instagram API during OAuth, synchronization, and token maintenance. Temporary API or token failures never trigger immediate deletion. A confirmed permanent disconnect removes the token and all API-derived Platform Data; plugin-owned media are deleted only when they are not referenced elsewhere in WordPress.

Missing posts are removed from the public feed only after three complete authoritative synchronizations and an optional grace period of up to 48 hours. The plugin synchronizes only media returned by Meta as media owned by the connected account. Native reposts and Collab posts owned by another account are not reliably returned and are therefore not supported or heuristically classified.

The plugin does not claim that a particular use is legally GDPR compliant. Operators remain responsible for published content, image rights, personal data, and their privacy notice.

See README.md for complete setup, security, WP-CLI, cron, troubleshooting, and browser acceptance instructions.

External services

Vemoro connection service

The recommended “Vemoro Login” relies on the connection service at https://connect.vemoro.de/ to complete Instagram OAuth without storing a Meta App Secret in WordPress. The service is provided by Vemoro and is required only when the administrator selects Vemoro Login and deliberately starts or completes a connection.

When a connection starts, the plugin sends the WordPress callback URL, site URL, plugin version and a random security state to the service. When the connection completes, it sends the one-time grant code and callback URL. The service temporarily processes the OAuth state and an encrypted one-time grant as described above; the permanent Instagram access token is returned to and stored encrypted in WordPress.

Vemoro service privacy information: https://vemoro.de/socialfeed/datenschutz/ Vemoro terms of use: https://vemoro.de/nutzungsbedingungen/ Data deletion instructions: https://vemoro.de/datenloeschung/

Instagram and Meta services

The plugin relies on Instagram’s authorization service, Instagram API and Instagram/Meta media delivery hosts to connect the selected professional Instagram account and synchronize its account-owned posts. These services are provided by Meta Platforms, Inc. A connection is made only after an administrator deliberately starts OAuth. Later server-to-server requests occur during manual or scheduled synchronization and token maintenance.

Depending on the selected connection method, OAuth sends the Meta App ID, callback URL, requested permission, random security state and authorization code. Expert mode additionally sends the configured App Secret during token exchange. API and token requests send the Instagram access token and the requested profile/media fields; pagination requests also send the cursor supplied by Instagram. Media synchronization downloads the image or video URLs returned by the API from allowed Instagram/Meta CDN hosts. As with any server request, the receiving service also receives the WordPress server’s IP address and standard HTTP request metadata. The plugin does not send the WordPress site URL in Instagram API request headers.

Ordinary frontend page views do not contact Instagram or Meta. If external Instagram links are enabled, a visitor contacts Instagram only after confirming the local privacy dialog and following a link.

Instagram service: https://www.instagram.com/ Instagram Terms of Use: https://help.instagram.com/581066165581870/ Instagram Privacy Policy: https://privacycenter.instagram.com/policy/ Meta Platform Terms: https://developers.facebook.com/terms/

Source code and development

The complete source code is maintained publicly at https://github.com/Vemoro/vemoro-socialfeed .

The JavaScript files in assets/js/ and CSS files in assets/css/ are the complete, human-readable source files executed by the plugin. They are maintained directly and are not generated, bundled, minified, or compiled. No npm, webpack, or other asset build step is required.

Development and test instructions are documented in the repository’s README.md. A distributable ZIP can be created from the repository root with ./tools/build-release.ps1 -OutputDirectory artifacts.

Voluntary support

Vemoro SocialFeed for WP remains free of charge, without advertising or tracking. Voluntary contributions through Liberapay or GitHub Sponsors help fund maintenance, security updates, hosting and operation of the Vemoro connection service.

Administrators see the optional support notice only on Vemoro SocialFeed administration screens. It can be postponed for 120 days or permanently hidden per user. The plugin does not load external resources for these notices; a connection to a funding service is made only after its link is clicked. Supporting is entirely voluntary and does not change the available features.

For technical questions and problems, contact support@vemoro.de. The address is displayed in the backend notice and the plugin administration area.