{ "title": "Smash Balloon Instagram Feed", "seo_title": "Smash Balloon Instagram Feed: review, settings, limits", "h1": "Smash Balloon Instagram Feed", "description": "Smash Balloon Instagram Feed free or Pro: strengths, limits, pricing, Business account requirement, recommended GDPR and cache settings, patched flaws.", "lead": "Smash Balloon Instagram Feed shows your Instagram posts in a grid on WordPress, with caching and local images. Our take on the free and Pro versions, what Instagram's API has required since 2024, the GDPR and cache settings to pick and the patched flaws.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-instagram-feed/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-instagram-feed/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-instagram-feed/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-instagram-feed/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:12:20+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Smash Balloon Instagram Feed", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-instagram-feed/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-instagram-feed/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/smash-balloon-instagram-feed/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Smash Balloon Instagram Feed", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/smash-balloon-instagram-feed/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/smash-balloon-instagram-feed/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/smash-balloon-instagram-feed/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Smash Balloon Instagram Feed", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/smash-balloon-instagram-feed/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/smash-balloon-instagram-feed/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/smash-balloon-instagram-feed/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Smash Balloon Instagram Feed", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/smash-balloon-instagram-feed/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/smash-balloon-instagram-feed/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/smash-balloon-instagram-feed/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Smash Balloon Instagram Feed", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/smash-balloon-instagram-feed/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/smash-balloon-instagram-feed/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/smash-balloon-instagram-feed/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Smash Balloon Instagram Feed", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/smash-balloon-instagram-feed/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/smash-balloon-instagram-feed/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/smash-balloon-instagram-feed/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Smash Balloon Instagram Feed", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/smash-balloon-instagram-feed/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/smash-balloon-instagram-feed/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/smash-balloon-instagram-feed/index.json" } ], "headings": [ { "level": 1, "text": "Smash Balloon Instagram Feed" }, { "level": 2, "text": "What Smash Balloon Instagram Feed does on your site" }, { "level": 2, "text": "Which sites get real value from a Smash Balloon Instagram feed" }, { "level": 2, "text": "Smash Balloon Instagram Feed strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The Instagram Feed settings we recommend" }, { "level": 2, "text": "Instagram Feed security: medium-severity flaws, all patched" }, { "level": 2, "text": "Smash Balloon Instagram Feed FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for shops and creators who want their Instagram posts on their site without posting twice.\n- Main caveat: a Business or Creator account is required, and lightbox, videos and hashtags are paid.\n- Free; Pro costs $98 per year for one site ($49 the first year).\n\n## What Smash Balloon Instagram Feed does on your site\n\nSmash Balloon Instagram Feed shows the posts of an Instagram account on your pages: a grid of photos and videos with a header (avatar, name, bio), a \"Follow\" button and a \"Load More\" button. Each feed is set up in a visual customizer with a live preview, then placed with a block, a widget, an Elementor widget, a Divi module or a shortcode.\n\nYou connect an account with a button that fetches a read-only access token, so there is no developer app to create. Since December 4, 2024, Instagram no longer lets personal accounts use its API: you need a professional account, either Business or Creator. The plugin caches posts, refreshes them in the background through WordPress cron and can store local WebP copies of the images in `/wp-content/uploads/sb-instagram-feed-images/`. If Instagram stops responding, the feed keeps showing the last posts it saved.\n\nThe developer, Smash Balloon LLC, also makes Facebook, YouTube and TikTok feed plugins. Instagram Feed Pro is a separate paid plugin. It adds the lightbox for photos, Reels and videos, captions and like and comment counts, the Masonry and Highlight layouts, and, depending on the plan, hashtag feeds and shoppable feeds.\n\n![Diagram: Smash Balloon Instagram Feed works on visitors and bots, wordpress, external services. Public traces: signed HTML comments (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/instagram-feed/diagram-en.svg?v=862a7aad)\n\n## Which sites get real value from a Smash Balloon Instagram feed\n\nThe plugin pays off when Instagram is already your storefront and you want to bring it to your site with no extra work:\n\n- **Restaurants, shops, creators and makers**: the site shows your latest photos automatically, with no double posting.\n- **Business sites that want a livelier home page or footer**: the free version handles a small grid of recent posts well.\n- **Brands that run a hashtag or sell from their photos**: hashtag feeds (Plus plan) and shoppable feeds (Elite plan) cover that need.\n\nIt is the wrong pick if your Instagram account is personal and must stay that way, if you want videos to play on your site without paying (the free version sends visitors to Instagram), or if a plain link to your profile is enough.\n\n## Smash Balloon Instagram Feed strengths and limitations\n\n### Strengths\n\n- **Quick to set up.** One-button connection with no Meta app to create, and a visual customizer with a live preview.\n- **Feeds that survive Instagram outages.** The cache keeps showing the last known posts, and an email report flags feeds that break.\n- **Optimized local images.** Copies in several sizes, WebP by default, served from your own server.\n- **Built-in GDPR mode.** The plugin detects Complianz, CookieYes, Cookiebot, Borlabs Cookie and other banners, and can display the feed with no request to Instagram at all.\n\n### Limitations\n\n- **Professional account required.** Since December 2024, a personal Instagram account can no longer be connected.\n- **Lightbox and video playback cost extra.** In the free version a click opens Instagram; captions and counts are Pro only as well.\n- **Hashtags start at the Plus plan.** Basic does not include them: you need Plus, $198 per year for five sites ($99 the first year).\n- **Introductory pricing on the first purchase.** Renewals are billed at full price: $98 per year for the Basic plan ($49 for the first year only).\n- **Tied to Meta's API.** A change in Instagram's rules can force you to reconnect your account, as personal accounts had to in 2024.\n\n## The Instagram Feed settings we recommend\n\nGlobal settings live under Instagram Feed > Settings, split into the General, Feeds and Advanced tabs; the look of each feed is set feed by feed under Instagram Feed > All Feeds. Save each tab, then run the checks below.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Caching** Instagram Feed > Settings > Feeds | In the Background, every 12 hours (default) | Fewer API calls; switch to every hour only if you post several times a day. |\n| **GDPR** Instagram Feed > Settings > Feeds | Automatic with a supported consent plugin, otherwise Yes | With Yes, no request goes to Instagram: local images only, and videos open on Instagram. |\n| **Image Optimization (Recommended)** Instagram Feed > Settings > Advanced | On, WebP format (defaults) | The feed loads the smallest local copy that fits the spot instead of the original image. |\n| **Enqueue CSS only on pages with the Feed** Instagram Feed > Settings > Advanced | On if the feed only appears on a few pages | Keeps the stylesheet off every other page; leave it off if the feed sits in a sitewide widget. |\n| **Load Initial Posts with AJAX** Instagram Feed > Settings > Advanced | On only if you use page caching | The feed updates even when the page stays cached for a long time; check the display after turning it on. |\n| **Feed Issue Email Reports** Instagram Feed > Settings > Advanced | On (default), with your address | You hear about it when a token expires or a feed goes down. |\n| **Usage Tracking** Instagram Feed > Settings > Advanced | Off (default) | The weekly report sent to Smash Balloon does nothing for your site. |\n| **MCP Write Access** Instagram Feed > Settings > General | Off (default) | Lets a connected AI agent (WordPress 6.9 and later) change your feeds. |\n\n- Open the page with the feed in a private window: images should show, even before cookies are accepted if GDPR mode is on.\n- On the General tab, check that each connected source is a Business or Creator account and that no token error is reported.\n- After changing a setting, click \"Clear All Caches\" on the Feeds tab, then purge your site's page cache.\n\nWithout GDPR mode, some images and videos can load straight from Instagram's servers, which sends the visitor's IP address to Meta: GDPR mode plus a consent banner such as [Complianz](https://www.wp-masquerade.com/features/camouflaged-plugins/complianz/) takes care of that (see also our article on GDPR and WordPress security).\n\n## Instagram Feed security: medium-severity flaws, all patched\n\nThe vulnerabilities published for the plugin are medium severity and require either an account or a victim clicking a crafted link:\n\n- **CVE-2025-4583**: stored [XSS](https://www.wp-masquerade.com/glossary/xss/) through the `data-plugin` attribute with a contributor account, up to version 6.9.0 of the free plugin and 6.8.0 of Pro (CVSS 5.4).\n- **CVE-2026-12002**: a [CSRF](https://www.wp-masquerade.com/glossary/csrf/) flaw up to version 6.11.1 that let an attacker overwrite the Instagram and Facebook oEmbed tokens if an administrator clicked a crafted link (CVSS 4.7).\n- **CVE-2026-15452**: reflected XSS through the page URL, with no account but a click from the victim, up to version 6.11.3 (CVSS 4.7).\n\nThe developer's changelog sums up recent security fixes as plain \"security hardening\", with no details, so turn on automatic plugin updates for Instagram Feed. The plugin also stamps every page of your site with an `` HTML comment, even pages without a feed (see [HTML comments and the generator tag](https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/)): WP Masquerade Pro removes it, which makes the plugin harder to spot for bots that target these flaws, without replacing the update.\n\n## Smash Balloon Instagram Feed FAQ\n\n**Can I connect a personal Instagram account?**\n\nNo. Since December 4, 2024, Instagram no longer opens its API to personal accounts. Switch your account to Business or Creator in the Instagram app (it is free), then reconnect it in the plugin.\n\n**Do I need a Facebook Page?**\n\nNot to show your own posts. Smash Balloon's documentation asks for a Facebook Page linked to the Business account only for hashtag and mention feeds, which are Pro features.\n\n**How much does Instagram Feed Pro cost?**\n\nAt full price, the pricing page lists $98 per year for one site (Basic), $198 for five sites (Plus), $298 for ten sites (Elite) and $598 for unlimited sites with every Smash Balloon plugin. The first year costs less ($49, $99, $149 and $299); renewals are always at full price.\n\n**Why doesn't my feed show new posts?**\n\nEither the plugin's cache has not refreshed yet, or a page cache is serving an old copy. Click \"Clear All Caches\" under Instagram Feed > Settings > Feeds, purge the site cache, and turn on Load Initial Posts with AJAX if it happens again.\n\n## Key facts\n\n- Category: Newsletter, pop-ups and sharing\n- Vendor: Smash Balloon LLC\n- Price: Free; Pro from $98 per year for one site ($49 for the first year)\n- Active installations (wordpress.org): 1 000 000+\n- Version: 6.15.1\n- Official page: https://wordpress.org/plugins/instagram-feed/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: signed HTML comments, folder name, tag IDs, generated-file folders\n- Still visible: JavaScript variables, CSS classes", "catalog": "instagram-feed", "essentials": [ "Best for shops and creators who want their Instagram posts on their site without posting twice.", "Main caveat: a Business or Creator account is required, and lightbox, videos and hashtags are paid.", "Free; Pro costs $98 per year for one site ($49 the first year)." ], "format": "application/json" }