---
title: "AddToAny Share Buttons"
description: "AddToAny Share Buttons: free share buttons, strengths, limitations (third-party service, ad blockers), recommended settings and patched vulnerabilities."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/addtoany-share-buttons/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T20:57:40+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/addtoany-share-buttons/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/addtoany-share-buttons/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/addtoany-share-buttons/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/addtoany-share-buttons/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/addtoany-share-buttons/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/addtoany-share-buttons/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/addtoany-share-buttons/index.md"
---

# AddToAny Share Buttons

AddToAny Share Buttons adds share buttons, a floating bar and a universal menu covering dozens of networks, free and with no account. Our take on what it offers, its reliance on addtoany.com, the display settings worth tightening and its rare vulnerabilities.

## The essentials

- Best for blogs and stores that want full-featured share buttons for free, with no account to manage.
- Main caveat: the script and links go through addtoany.com, and ad blockers can hide the buttons.
- Free with no sign-up or paid plan; floating bars and share counters are included.

## What AddToAny Share Buttons does on your site

AddToAny Share Buttons adds share buttons below your content: Facebook, Mastodon, Email and the universal button by default. The universal button opens a menu with every supported service (Bluesky, WhatsApp, Pinterest, LinkedIn, Reddit, Threads, X and more). The menu puts the services each visitor actually uses at the top, and AddToAny keeps the service list current on its side, without waiting for a plugin update. Settings live under Settings > AddToAny, in two tabs: Standard (buttons in your content) and Floating (vertical and horizontal bars that stay on screen while visitors scroll).

On the front end, the plugin loads a script hosted on `static.addtoany.com`, deferred so it doesn’t block rendering, and its share links go through addtoany.com before reaching the chosen network. You also get an `[addtoany]` shortcode, a share widget, an “AddToAny Follow” widget for linking your profiles (Instagram, YouTube and others), share counters for a few services, Google Analytics integration and AMP support. On WooCommerce product pages, the buttons move into WooCommerce’s own sharing area.

AddToAny has been around since 2006. The service is free, with no sign-up or account, and the plugin has no paid tier.

![Diagram: AddToAny Share Buttons works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible); files served by the vendor (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/addtoany/diagram-en.svg?v=795f74bb)

## Which sites AddToAny is a good fit for

AddToAny makes sense when you want full-featured share buttons without paying or managing an account:

- **Blogs, magazines and news sites**: buttons under every post, a floating bar and the universal menu for less common networks.
- **WooCommerce stores**: product pages can be shared, Pinterest included, without a paid plugin.
- **Sites that track their shares**: the Google Analytics integration and URL shortener support (Bitly or your own short URLs) show what gets shared.

It’s the wrong pick if your policy rules out any request to a third-party service, since the script and the share links both depend on addtoany.com. And if you already run [Jetpack](https://www.wp-masquerade.com/features/camouflaged-plugins/jetpack/), its social sharing module may be all you need, with no extra plugin.

## AddToAny strengths and limitations

### Strengths

- **Completely free.** Floating bars, counters, follow buttons and custom icons are all included, with no account and no paid plan.
- **Services stay current.** Share endpoints and icons are updated on AddToAny’s side when a network changes, without waiting for a new plugin release.
- **Light loading.** The script is deferred and the icons are SVGs that stay sharp at any size.
- **Consent-aware.** With Complianz or the WordPress Consent API, official buttons (Facebook Like, Pinterest Save) wait for the visitor’s marketing consent.
- **Very few published vulnerabilities.** Three in total, all patched, the latest in 2021, and none exploitable without an admin account or special conditions.

### Limitations

- **Relies on addtoany.com.** The script and share links go through AddToAny’s servers: if they can’t be reached, the universal menu doesn’t work.
- **Hidden by some ad blockers.** The plugin’s own FAQ admits that browser add-ons filter out social buttons for some visitors.
- **No dedicated block.** In the block editor you use the shortcode, a widget or a PHP function in your theme.
- **Advanced tweaks mean code.** Beyond the settings, the documentation has you paste JavaScript or CSS into the plugin’s screen.
- **Limited counters.** Share counts only cover Pinterest, Reddit, Tumblr and the universal button.

## The AddToAny settings we recommend

Out of the box, AddToAny shows its buttons at the bottom of posts, pages, excerpts, archives, the RSS feed and media pages. These settings narrow that down to content people actually share.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Share Buttons**  Settings > AddToAny > Standard | 3 to 5 services your audience uses | A short row is easier to scan; the universal button covers every other service. |
| **Universal Button**  Same screen | Keep it (default) | Choosing “None” disables universal sharing, which is why the plugin asks you to confirm. |
| **Official buttons** (Facebook Like, Pinterest Save, LinkedIn Share) Same screen, Share Buttons | Leave them out, or use them only with a consent plugin | They are served by the networks themselves, under their own privacy policies. |
| **Display on excerpts and archive pages**  Settings > AddToAny > Standard > Placement | Off | Avoids a row of buttons under every summary in post lists, category pages and search results. |
| **Display on media pages**  Same section | Off | Attachment pages rarely get shared and are often nearly empty. |
| **Cache AddToAny locally with daily cache updates**  Same tab, Advanced Options | Off (default) | AddToAny itself says most sites shouldn’t use it: many visitors already have its script cached. |
| **Additional JavaScript**  Same tab | Empty, unless you follow documented customization | This code runs on every public page; only keep what you understand. |
| **Responsiveness of floating bars**  Settings > AddToAny > Floating | Hiding on (defaults: 980 and 981 pixels) | The vertical bar disappears on phones and the horizontal bar on desktops, so each screen gets one bar. |
| **Show sharing buttons.**  Editor, AddToAny box | Unchecked on legal pages, cart, checkout and customer account | Sharing makes no sense there, yet page display covers them by default. |

- Open a post in a private window: the buttons show below the content and a click opens the chosen network.
- Load a category page and a legal page: no buttons should appear on either.
- If your site sends a [Content Security Policy](https://www.wp-masquerade.com/glossary/content-security-policy/), check the browser console to make sure `static.addtoany.com` isn’t blocked; AddToAny supports a CSP nonce.
- On a phone, check that only one floating bar is visible and that it doesn’t cover any button.

## AddToAny security: three old vulnerabilities, all patched

The WPScan and Patchstack databases list three vulnerabilities for AddToAny, all patched long ago:

- **CVE-2021-24568, fixed in 1.7.46**: the Sharing Header setting wasn’t sanitized on output, so an administrator without the `unfiltered_html` capability could inject a script ([stored XSS](https://www.wp-masquerade.com/glossary/xss/)).
- **CVE-2021-24616, fixed in 1.7.48**: the same kind of flaw, through the universal button’s image URL.
- **Host header injection**, fixed in 1.7.15 in 2017, under specific conditions.

The two 2021 flaws only matter on sites where administrators are deliberately denied the right to add code, as on some multisite networks; our guide to roles and least privilege covers that setup. The useful habit is still keeping the plugin updated, ideally with automatic plugin updates. WP Masquerade Pro renames the `add-to-any` folder in file URLs and strips the IDs from its tags; the `a2a_config` object, the `a2a_kit` classes and the `static.addtoany.com` script stay visible because the buttons need them.

## AddToAny frequently asked questions

**Is AddToAny really free?**

Yes. AddToAny states that its service is free, with no sign-up or account, and the plugin has no features locked behind a paid plan.

**Is AddToAny GDPR compliant?**

AddToAny says it is GDPR and CCPA compatible by default and doesn’t store personal data; its privacy policy says server logs are deleted within 30 days. Visitors’ browsers still contact its servers, so mention the service in your privacy policy and handle the networks’ official buttons with a consent tool such as [Complianz](https://www.wp-masquerade.com/features/camouflaged-plugins/complianz/).

**Why don’t some visitors see the buttons?**

Usually an ad blocker or a social-button filter stops AddToAny’s script from loading. Test in another browser; if nobody sees them, temporarily deactivate your other plugins to find a conflict.

**How do I remove the buttons from a specific post or page?**

In the editor, uncheck “Show sharing buttons.” in the AddToAny box, then save. For a whole category or post type, the documentation offers the `addtoany_sharing_disabled` PHP filter.

**Can I link to my Instagram or YouTube profiles?**

Yes, with the “AddToAny Follow” widget under Appearance > Widgets or in the Customizer. These networks don’t offer web sharing, so they are available as follow buttons.

## Key facts

- Category: Newsletter, pop-ups and sharing
- Vendor: AddToAny
- Price: Free, no sign-up and no paid plan
- Active installations (wordpress.org): 300 000+
- Version: 1.8.18
- Official page: https://wordpress.org/plugins/add-to-any/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only
- With Pro: folder name, tag IDs
- Still visible: JavaScript variables, CSS classes, files served by the vendor