instopress-social 1.5.0 – 1.32.0

View this Project on GitHub (IslayAnderson/instopress-social)

WordPress Org refused our submission, woooooooo 😭

1.32.0 — Faster first paint

• The whole first row of the grid loads first. Every picture tile in the top row now gets fetchpriority="high", not just the first one. The tiles are all the same size, so the page’s largest paint is whichever of them shows first.
• Scripts are deferred. The plugin’s front-end scripts (app, stories, composer) now load with defer, so they’re out of the critical request chain. On WordPress before 6.3 they stay in the footer as before.

1.31.0 — Deferred videos

• No video downloads on page load. Videos in home feed cards and on post pages used to fetch data as soon as the page opened. Now they wait.
• With a poster, the poster shows and the video loads only when it’s played.
• Without a poster, a single frame loads once the video scrolls near the screen, as grid tiles already did.

1.30.0 — No render-blocking stylesheet

• The stylesheet is inlined. On instopress pages, the plugin’s stylesheet is now printed directly in the page’s <head> instead of loaded as a separate file, so nothing holds up the first paint.
• No flash of an unstyled page. The stylesheet styles the whole page on these views, so deferring it would show the page unstyled for a moment. Inlining avoids that, and pages look exactly as before.
• About 7 KB more per page after compression; the separate request is gone.
• Prefer a linked file (e.g. for a strict Content-Security-Policy)? Return false from the iar_inline_styles filter.

1.29.0 — Smaller downloads

• Release builds now include minified CSS and JavaScript (style.min.css, app.min.js, …), roughly 40% smaller before compression. The plugin serves them automatically. For example, app.js goes from 31 KB to 18 KB and style.css from 36 KB to 28 KB.
• Readable files when you need them: with SCRIPT_DEBUG on, or when running the plugin straight from source without a build, the original files are used.
• Both the Pro and WordPress.org zips include the minified files.

1.28.0 — Faster

Faster profile grid on phones

• The first picture loads first. The first tile that actually shows a picture gets top priority; text posts and videos without a poster are skipped, since they have no image to fetch.
• The first three rows load straight away; the rest still load as you scroll.
• Phones download small copies. Tiles now carry srcset/sizes.
• A new 480px “tile” image size fills the gap between 300px and 768px. New uploads get it automatically. Existing pictures are filled in a few at a time in the background, or all at once with wp instopress-social tiles.

Faster pages on the server (profiled with php-spx)

• Batched media loading: the home feed and RSS feed load their posts’ media in a few database queries instead of one per image.
• Less repeated work: each post’s media is worked out once per page, grid tiles build only their first slide, the feeds skip an image size they never use, and photo/video checks read the attachment’s type directly.
• On a test site: the home feed and RSS feed render about 30% faster, and the plugin’s own share of that work dropped by more than half. Pages are byte-for-byte the same.

1.27.0 — New name: instopress-social

The plugin is now instopress-social (instopress-social Pro here on GitHub), and the repository has moved to IslayAnderson/instopress-social.

• Everything now uses the new name: the plugin, its folder, the post types, the feed (urn:instopress-social:1), the settings page, the WP-CLI command (wp instopress-social, short wp insto) and the zips.
• The update moves itself. From 1.26.1 or later, the plugin moves to its new instopress-social/ folder and stays active and auto-updating.
• Your content carries over. Posts, stories, likes, comments, settings and follows are kept; existing posts and stories move to the new post types automatically.
• Old addresses keep working. The old feed and settings-page addresses redirect, theme overrides in the old folder are still used, and feeds from sites that haven’t updated yet are still read.
• Wording changes: imported likes and comment counts are now labelled “imported”, and descriptions no longer use other services’ brand names.

1.26.2 — Bridge fix for the new name

• When the renamed plugin (instopress-social, coming in 1.27.0) installs, it now stays switched on however the update is run: from the Plugins screen, the Updates screen, automatically, or with WP-CLI. Before, an update started from a single “Update now” link could leave it deactivated.
• Please update to this version before 1.27.0.

1.26.1 — Getting ready for the new name

The plugin is about to be renamed instopress-social. This release prepares for that, so the switch is automatic. Please update to it before 1.27.0.

• Updates keep working after the rename. Updates are also accepted from the renamed GitHub repository (IslayAnderson/instopress-social) and its new zip names.
• The new version moves itself. When the renamed version installs, it moves to its new instopress-social/ folder and stays active, network-active and auto-updating.
• Renamed sites stay followable. Feeds and Follow links from sites already on the new name are recognised.
• Usage statistics read their Google Analytics details from the new address on the author’s site, with the old one as a fallback.

1.26.0 — Two editions: Pro and WordPress.org

instapress-social now comes as two plugins built from the same code.

Already using instapress-social? You’re on Pro. This update keeps your bot protection, settings and automatic updates exactly as they are. The plugin is now listed as instapress-social Pro on your Plugins screen.

Both zips install as instapress-social/, so use one or the other, not both.

The readme now has an External services section listing everything the plugin talks to, with links to each service’s terms and privacy policy.

1.25.2 — Plugin Check clean-up

No new features. This tidies the code against WordPress’s Plugin Check.

• Translations: every translatable string with placeholders now has a translators: comment explaining them.
• Escaping: the RSS feed escapes its output with esc_xml() directly.
• Files: import jobs, the download package and imported media dates use WordPress’s filesystem API instead of PHP’s unlink, rmdir, rename, touch and move_uploaded_file.
• Input: request values are sanitised where they’re read, and templates/parts/sprite.php blocks direct access.
• ACF: the media gallery is validated from the files themselves, without borrowing ACF’s text domain.
• Readme: adds the “Tested up to” header.
• Hidden files: release zips and the “Get instapress-social” download no longer include hidden files. An IDE settings folder had slipped into earlier zips.

The remaining Plugin Check errors only apply to plugins hosted on WordPress.org: the GitHub updater (Update URI), and loading Turnstile and reCAPTCHA from Cloudflare and Google.

1.25.1 — Unfollow fix

• Fixed: Unfollow could look like it did nothing. Following someone again through their new feed address (/social/feed/) added them a second time, so Unfollow removed one copy and they stayed in your list.
• No more duplicates: following someone you already follow now updates the existing follow, Unfollow removes every copy, and duplicates already in your list are merged automatically.
• Clearer feedback: the Following page now confirms Unfollowed @name, Refreshed @name (or why a refresh failed), and Refreshed everyone you follow.

1.25.0 — One-step following

• The Follow button opens a dialog asking for the address of your own instapress-social site (e.g. your-site.com). Your browser remembers it, so next time it’s already filled in.
• Continue opens your site’s Following page in a new tab, with that profile filled in and shown (picture, name and site), and the Follow button ready. Press it to confirm; nothing is followed without that click. If you’re logged out, your site asks you to log in first and then carries on.
• Your site needs 1.25.0 or later for the link to land on its Following page.
• The dialog still has “Copy the feed link instead”, plus “Get instapress-social” for visitors without a site of their own.

1.24.1 — Story button fix

• Fixed: the + on your story ring in the home feed stretched to the full width of the story. It’s a small round button at the corner of your profile picture again.

1.24.0 — Feed moves to /social/feed/

• Your feed now lives inside your profile folder, at /social/feed/ (or /gram/feed/, whatever your profile folder is) instead of /feed/insta/. If you change the folder, the feed moves with it.
• Nothing breaks. /feed/insta/ and ?feed=insta redirect permanently (301) to the new address, so existing followers and feed readers keep working.
• Sites following you update themselves. Once they’re on 1.24.0, they switch to the new address on their next refresh.
• The Follow button, the feed link in your page’s <head>, and the Following screen all show the new address.

1.23.0 — Anonymous usage statistics

The plugin now shares anonymous usage statistics from its admin screens with its author, to help decide what to improve. They go alongside the existing one-off setup event.

• What’s sent:
  • which instapress-social screens are opened (posts, editor, stories, Import, Following, Settings);
  • which actions are used: settings saved (the names of the settings that changed, never their values), follow, unfollow and refresh, import start and cancel, check for updates, publishing from the composer (post, text or story), and changing a post’s status.
• Every event carries: the site’s domain, the plugin and WordPress versions, and the environment type. Never post content, settings values, users or visitors.
• Sent from the server, without waiting for an answer, so wp-admin isn’t slowed down. Nothing is loaded in your browser.
• Turn it off under Settings → instapress-social → Privacy → “Share anonymous usage statistics”. A notice on the plugin’s screens says this once. define( 'IAR_DISABLE_SETUP_EVENT', true ); and the iar_send_usage_stats filter also switch it off.

1.22.0 — New defaults

For new installs, the plugin now starts with:

• Profile folder /social/ (was /gram/), so the home feed and New post page are at /social/home/ and /social/new/.
• The WordPress toolbar hidden on instapress-social pages.
• The home feed private to you (and anyone who can edit posts).

Everything else is unchanged.

Already using the plugin? Nothing changes for you. If you never changed these settings, this update keeps your profile at /gram/, the toolbar showing and your home feed public. You can switch any of them under Settings → instapress-social.

1.21.0 — Privacy options

New under Settings → instapress-social → Templates → Privacy:

• Only I can see my home feed. The home feed (/gram/home/) shows posts and stories from everyone you follow, which reveals who you follow. With this on:
  • visitors are asked to log in;
  • logged-in people who can’t edit posts see “This home feed is private” with a link to your profile;
  • the Home links in the profile tabs and bottom bar are hidden from them.
• Hide follower and following counts from visitors. The counts on your profile only show for you and anyone who can edit posts.

Both are off by default. You (and anyone who can edit posts) always see everything.

1.20.0 — Hide the WordPress toolbar

• New option: Settings → instapress-social → Templates → “Hide the WordPress toolbar on these pages”. It gives a cleaner, app-like look when you’re logged in.
• It only affects instapress-social pages (profile, home feed, posts and New post). wp-admin and the rest of your site keep the toolbar.
• wp-admin is still a tap away: the ⋯ menu on a post has Edit in WordPress.
• Off by default, so nothing changes until you switch it on.

1.19.0 — Choose your own addresses

• Settings → instapress-social now has two new settings:
  • Profile folder (default /gram/). Your home feed and New post page sit inside it, at …/home/ and …/new/.
  • Post folder (default /p/, as in /p/<shortcode>/).
• Rules: lowercase letters, numbers and dashes, and the two folders must differ. Names WordPress already uses (feed, wp-admin, page…) and addresses of your existing pages are refused, with a message saying why.
• Old links keep working. After a change, the old addresses redirect permanently (301) to the new ones. That covers profile, home feed, composer and post links, including links on sites that follow you.
• The iar_archive_slug and iar_post_slug filters still work and take priority over the settings.

1.18.0 — Text posts and a post menu

Text posts

• A new Text tab in the composer (/gram/new/): write a short post and style it as a card.
• Rich text: bold, italic, underline, strikethrough, headings, quotes, bulleted and numbered lists, and links. Pasted text arrives plain.
• Look: text size (50–200%), four fonts (Classic, Serif, Typewriter, Strong), alignment, text colour (automatic, presets or your own), and a background from 10 colours, 10 gradients or your own colour. Shape, caption and location work as for photo posts.
• Drawn as SVG, not a baked image. The words stay real text: sharp at any size and selectable, and links work on the post page. Followers’ sites and RSS readers get the card as an .svg file, and the feed item’s title and description carry the text.
• They’re ordinary posts: shortcode permalinks, the grid, likes, comments, the home feed and your feed all work. You can also make or edit one in wp-admin by setting Media type to Text.

Post menu

• When you’re logged in, the ⋯ button on a post (post page and home feed) opens a menu: Published, Private (only you) or Draft (hidden); Move to bin (asks first); Edit in WordPress; and View original post for imported posts.
• Your drafts and private posts stay visible to you in the grid and on their /p/ pages, with a badge, so you can switch them back. Visitors get a 404 for them, they aren’t indexed, and they’re left out of your feed.

1.17.1 — Feed freshness fix

• Fixed: RSS readers could be told /feed/insta/ hadn’t changed (HTTP 304 Not Modified) after a new story, a like or comment, a story expiring, a deletion or a profile edit. The feed’s Last-Modified date only followed post edits.
• Last-Modified, the ETag and <lastBuildDate> now use the newest of all of these, so readers always get the current feed.
• Sites following you through instapress-social weren’t affected; they always fetch the full feed.

1.17.0 — More reliable posting from your phone

• Lighter uploads. The composer (/gram/new/) now resizes photos in your browser to at most 2160 px (JPEG) before uploading. Full-size camera photos, which could overload the server and fail with HTTP 500, now go up at about a quarter of the size. Small JPEGs and GIFs are sent unchanged.
• Real error messages. If the server still fails, you see what went wrong and at which step (uploading, saving the video poster, or publishing) instead of “Upload failed (HTTP 500)”.
• Composer uploads get more server memory and time.

1.16.0 — Faster profile grid

• First row loads straight away. The top tiles were all lazy-loaded, so the page’s largest image started late. Now the first six load immediately, the very first with high priority.
• Videos without a poster wait their turn. Each one used to start downloading its video file to show a frame, crowding out the images above it on slow connections. They now load only when scrolled into view. Generating posters (instapress-social → Import → Video posters → Generate missing posters) is still the best fix, since a poster is a small image.
• Far fewer database queries. The grid now loads all its photos, videos and posters together: 449 → 39 queries for a 24-post page, which shortens server response time.

1.15.0 — Analytics secret no longer in the plugin

• The Google Analytics API secret used by the one-off plugin_setup event is no longer built into the plugin. It’s read from blog.islayanderson.co.uk/wp-json/instapress/v1/ga-secret when needed and cached for 12 hours.
• If it can’t be fetched, nothing is sent; the event is retried later (at most once an hour) and only marked as sent once it actually goes out.
• Opting out is unchanged: define( 'IAR_DISABLE_SETUP_EVENT', true ); in wp-config.php, or the iar_send_setup_event filter.

1.14.0 — Install count

• When the plugin is set up (activated, or the first admin page load after this update), it sends one plugin_setup event to the plugin author’s Google Analytics through the GA4 Measurement Protocol.
• The event contains the site’s domain, the plugin and WordPress versions and the environment type (production, staging, local). Nothing about visitors, posts or users is sent.
• To opt out: add define( 'IAR_DISABLE_SETUP_EVENT', true ); to wp-config.php, or return false from the iar_send_setup_event filter. Details are under Privacy in readme.txt.

1.13.0 — No more pop-up post viewer

• Tapping a post in the profile grid (or Reels) now opens the post’s own page at /p/<shortcode>/ instead of a pop-up. Likes, comments, the carousel and sharing all work there as before.
• Smaller pages: the grid no longer embeds every post’s media and caption, and the viewer’s script and styles are gone.
• If you overrode parts/footer.php or parts/grid-item.php in your theme, the old modal markup in them is now unused and can be removed.

1.12.0 — Post from your phone

• New post at /gram/new/: tap the + in the bottom bar (or New post on your profile). No wp-admin needed.
• Pick up to 20 photos and videos, reorder or remove them, choose the shape (Auto, 1:1, 4:5, 3:4, 1.91:1, 9:16), and add a caption and location. Sharing gives the post a shortcode permalink straight away.
• Story mode: one photo or video, with optional text and a link. The + on the home feed’s stories row opens it.
• Videos get a poster captured in your browser automatically.
• Only logged-in users who can publish posts can use it; others are sent to log in. Files picked but never shared are deleted after a day.

1.11.0 — Regenerate all video posters

• Regenerate all posters (instapress-social → Import → Video posters): recaptures a frame from every video and replaces its poster, for when some are black, blurry or badly timed.
• Choose the moment: set the frame time (default 0.5 seconds; e.g. 1 or 2 seconds to skip a fade-in). Videos shorter than that use their middle frame.
• Asks for confirmation first. Posters the plugin made before are deleted, so your media library doesn’t fill up; cover images imported from Instagram are always kept. A single-video post’s featured image follows its new poster.
• “Generate missing posters” still only fills in videos without one.

Keep the page open until it finishes: the frames are captured in your browser.

1.10.0 — Choose your bot protection

• Bot protection now offers three providers for comments and likes (Settings → instapress-social → Bot protection):
  • Cloudflare Turnstile: as before. Existing Turnstile setups carry on unchanged.
  • Google reCAPTCHA v3: invisible and score-based, with a minimum score setting (default 0.5).
  • Google reCAPTCHA v2 (invisible): may show an image challenge when Google is unsure.
• Each provider has its own site key and secret. Every request is checked server-side for success and your site’s hostname, plus the action (Turnstile, v3) and the score (v3).
• Wrong-secret warning: Google can’t confirm reCAPTCHA secret keys when you save them. If the provider ever rejects your secret during real use, an admin warning appears, so a typo can’t silently block every comment and like.
• The bot-check script is no longer loaded for comment moderators, who are never checked. The reCAPTCHA badge sits above the mobile bottom bar.

reCAPTCHA keys: create them at google.com/recaptcha/admin, choosing Score based (v3) or Challenge (v2) → Invisible reCAPTCHA badge. Keys for one version don’t work with the other. reCAPTCHA loads Google scripts on your instapress-social pages, so mention it in your privacy and cookie notice.

1.9.0 — Bot protection with Cloudflare Turnstile

• Optional Turnstile check on comments and likes. It’s usually invisible: visitors only see a challenge if Cloudflare thinks it’s needed. Every comment and like gets a fresh single-use token, which WordPress checks with Cloudflare before accepting. It requires the right action (comment / like) and your site’s own hostname, and rejects the request if the check fails or Cloudflare can’t be reached. Comment moderators (you) are never challenged.
• Secret key handling: checked with Cloudflare when you save it, never shown again, and kept out of autoloaded options. You can also set it as IAR_TURNSTILE_SECRET in wp-config.php.
• Off until both keys are set, so updating changes nothing on its own.

To switch it on: Settings → instapress-social → Bot protection. Paste your widget’s site key and secret key (Cloudflare dashboard → Turnstile → your widget → Settings), tick Comments and/or Likes, and save. Your widget’s domains must include the site’s hostname.

1.8.0 — Likes & comments

• Comments are real WordPress comments, shown beside the photo and in the grid pop-up, with replies. Your Discussion settings, moderation, Akismet and notification emails all apply; manage them under Comments. Imported Instagram comments show as “N earlier comments on Instagram”.
• Anonymous commenting: visitors don’t need an account. The first time they post, a pop-up asks for their email (required, never shown) and an optional name — blank posts as “Anonymous” — and can remember them on that device.
• Likes: anyone can like a post (one like per browser; tap again to unlike), or double-tap the photo. Likes are stored as WordPress comments of the type “Likes” (filter for them on the Comments screen) and are kept out of comment lists and counts. Totals include your imported Instagram likes.
• Settings → instapress-social → Likes & comments turns either off. Comments are opened on existing posts once.

If you use the Disable Comments plugin with “Everywhere” selected, comments stay hidden (likes still work). To allow them on instapress-social posts only: Disable Comments → Settings → On specific post types → tick Posts, Pages and Media, leaving instapress-social unticked. The plugin shows a notice with this link.

1.7.3 — Hand-made video posts

• Fixed: posts with a video couldn’t be saved on sites running ACF 6.8.7 or newer (“File must be a valid image”), and the media picker refused videos. The Media gallery accepts photos and videos again; anything else is still rejected.
• Media type sets itself from the gallery when you save: one video = Video, several items = Carousel. Existing posts are corrected once after updating, so video posts you made by hand now appear in the Reels tab.
• Video posters now finds every video without a poster, including in hand-made posts.
• On a post’s edit screen, a video without a poster shows a Generate poster now button.

After updating: open any page in wp-admin once (that runs the correction), then instapress-social → Import → Generate video posters for anything new.

1.7.2 — Video posters

• Fixed: on sites using the Default Featured Image plugin (or anything similar), every video without its own poster showed the site’s default image. Posters now only come from the video’s own poster image, or a single-video post’s own featured image.
• Videos without a poster show their first frame in the grid instead of a broken image.
• New: Video posters tool (instapress-social → Import, at the bottom). It lists videos that have no poster and, with one click, grabs a frame from each in your browser and saves it as the video’s poster, so they look right everywhere, including on phones and in link previews.

After updating: open instapress-social → Import and press Generate video posters once.

1.7.1 — imginn scraper fixes

• Stops when the grid ends. Profiles whose post count includes reels imginn doesn’t list (e.g. “128 posts” with 22 shown) made the scraper keep scrolling for a minute or more. It now stops as soon as there’s no “load more” and nothing new appears, and says how many it found.
• Reels are collected too (/reel/ and /tv/ links), each fetched at its own address.
• Stop & save button in the progress box: ends early and still downloads posts.json with what’s been scraped.
• An error no longer leaves it stuck on “already running” — just click the bookmarklet again.

After updating, re-drag the bookmarklet from instapress-social → Import: the bookmark holds its own copy of the script.

1.7.0 — Automatic updates

• Updates from GitHub Releases. New versions now appear on the Plugins screen like any other plugin, with Update now, View details (release notes) and the Enable auto-updates toggle.
• Only zips attached to releases of this repository are accepted. The check is cached for 6 hours, so it stays well within GitHub’s limits.
• Check for updates and Releases links under the plugin on the Plugins screen.

Upgrading from 1.6.0 or earlier: upload this zip once by hand. From then on updates arrive automatically.

1.6.0 — Stories

• Stories: a new instapress-social → Stories post type — one photo or video, optional overlay text, a link button and display time.
• Full-screen viewer: progress bars, auto-advance, tap left/right to go back/forward, hold to pause, swipe down or Esc to close, sound toggle for video. Seen stories turn the ring grey.
• Rings: your profile picture gets the gradient ring while you have live stories; the home feed’s stories row shows you and everyone you follow, and plays them one after another.
• Ephemeral: stories disappear after 24 hours (Settings: 1–168h). They’re hidden the moment they expire, then an hourly job moves them to a private Expired archive — or deletes them, if you prefer.
• Shared with followers through the same /feed/insta/ link, as entries ordinary RSS readers ignore. Sites on older versions keep working; they just won’t show stories until they update.

1.5.2 — Licensing

• Now licensed under the MIT License (© 2026 Islay Anderson), replacing the WTFPL. The LICENSE file is in the zip.
• No functional changes from 1.5.0.

1.5.1 — Licensing

• Now licensed under the WTFPL — the LICENSE file is included in the zip, and the plugin header/readme say so.
• No functional changes from 1.5.0.

1.5.0 — Grid

• Profile grid at /gram/ (Posts / Reels / Home tabs, post modal with carousel, load more, ?hashtag= filter) and single post pages at /p/<shortcode>/.
• Short-code permalinks with a Generate shortcode button — codes encode the post date.
• Aspect ratios per post (Auto, 1:1, 4:5, 3:4, 1.91:1, 9:16, Original) and grid tile shape.
• Following: the Follow button copies your feed link (/feed/insta/); paste others’ links into instapress-social → Following and their posts appear in your home feed at /gram/home/.
• Get instapress-social button so visitors can download the version you run.
• Import from imginn: one-click bookmarklet → posts.json, then upload it (with a media zip or server folder) on the Import page, preview, and import in the browser — or wp instapress-social import.
• Upload posts.json (plus a media .zip or a server folder) on the Import page, preview, then import in the browser with a progress bar.
• Re-importing without the media no longer drops files that are already in the media library.

View this Project on GitHub (IslayAnderson/instopress-social)