A Joomla site module that displays public Instagram posts through Instagram’s official embed. No API key, app registration or account login required.

Version 1.0.0 · Joomla 4.4 / 5 / 6 · PHP 8.1+ · GPLv2+ · by Saint Art Designs

Contents

1. Overview
2. Requirements
3. Installation
4. Creating the module
5. Using a manual list of posts
6. Using an RSS bridge feed
7. All configuration options
8. Render modes explained
9. Styling & CSS customisation
10. Caching behaviour
11. Troubleshooting
12. FAQ
13. License

1. Overview

Embed Instagram Posts resolves a list of Instagram post permalinks and renders each one using Instagram’s public embed. Because it never talks to the Instagram Graph API, there is nothing to authenticate: you do not create a Meta app, you do not generate tokens, and there is no token expiry to maintain. The only requirement is that the posts are public.

Permalinks come from one of two sources, selected with the Post source option:

• Manual list – you paste post URLs directly.
• RSS bridge feed – the module fetches an RSS feed and extracts Instagram links from it automatically.

2. Requirements

3. Installation

1. Log in to the Joomla administrator.
2. Go to System → Install → Extensions.
3. On the Upload Package File tab, drop mod_embed_instagram_posts-1.0.0.zip or browse for it.
4. Wait for the “Installation successful” message.

To update later, install the newer ZIP the same way — the package uses method="upgrade", so it installs over the existing version without losing your settings.

4. Creating the module

1. Go to Content → Site Modules and click New.
2. Select Embed Instagram Posts from the list.
3. Give it a title (or hide the title), choose a Position, and set Status to Published.
4. On the Menu Assignment tab, choose where it should appear (all pages or specific menu items).
5. Configure the options (below) and click Save.

Helix Ultimate / template positions: a module only renders if its position is actually output by the active template. If you see nothing on the front end, verify the position first – see Troubleshooting.

5. Using a manual list of posts

1. Set Post source to Manual list of post URLs.
2. In Post URLs, paste one URL per line, for example:

https://www.instagram.com/p/DbC3mk_inwo/
https://www.instagram.com/reel/Cxyz1234abc/
https://www.instagram.com/username/p/DdEf5678ghi/

Post, reel and IGTV (/tv/) URLs are all accepted, with or without the username in the path. Duplicate posts are removed automatically, and the module shows at most Number of posts items.

6. Using an RSS bridge feed

Instagram does not provide RSS itself, so RSS mode relies on a third-party bridge that turns an Instagram profile into an RSS feed (for example RSS.app or FetchRSS). The module then reads that feed and pulls out the Instagram links.

1. Create a feed for your Instagram profile in the bridge service.
2. Copy the direct feed URL – the one that returns XML. On RSS.app this is the RSS Feed URL and usually ends in .xml, e.g. https://rss.app/feeds/XXXXXXXX.xml.
3. Set Post source to RSS bridge feed URL and paste the URL into RSS feed URL.
4. Save.

Most common mistake: pasting the feed’s share / preview page link (e.g. https://rss.app/r/feed/…) instead of the direct .xml feed. The preview page returns HTML, not a feed, so the module finds no Instagram links and shows nothing. Always use the URL that ends in .xml.

The module requires the feed items to contain real Instagram permalinks (instagram.com/p/…, /reel/… or /tv/…). Some free bridges rewrite item links to their own redirect domain – if so, the module cannot detect the posts.

7. All configuration options

Source

Layout

Advanced

Standard Joomla module options are available too: alternative Layout, Module Class Suffix, module tag, Bootstrap size, header tag/class and module style (chrome).

8. Render modes explained

Iframe (recommended)

Each post is embedded in its own <iframe> pointing at Instagram’s /embed/ endpoint. No third-party JavaScript is loaded into your page, embeds are isolated from your site, and the height is fixed by the Embed height option.

Instagram embed.js

Posts are rendered as Instagram’s official blockquote cards, enhanced by Instagram’s embed.js script loaded from instagram.com. This produces the familiar rich card and auto-sizes to content, but it does load remote JavaScript from Meta.

9. Styling & CSS customisation

The bundled stylesheet lays posts out in a responsive CSS grid driven by CSS custom properties. The module wrapper uses the class eip; the grid, items, embeds, follow link and notice use eip-grid, eip-item, eip-embed, eip-follow and eip-notice.

To override styles from your template, target those classes, for example:

.eip-embed { border-radius: 16px; }
.eip-grid  { gap: 24px; }
.eip-follow a { font-weight: 700; }

If you prefer to control everything yourself, set Load module CSS to No and add your own rules. You can also add a Module Class Suffix to scope your CSS to a single module instance.

10. Caching behaviour

In RSS mode the fetched feed is cached per module instance under Joomla’s cache directory for the number of minutes set in Cache time. This avoids querying the bridge on every page view. If a refresh fails, the module keeps serving the last successful set of posts and, for logged-in administrators only, shows a small notice that cached content is being used. Manual mode does not fetch anything, so it is not cached.

11. Troubleshooting

Nothing appears on the page

1. Check the module position. The most common cause. Enable Preview Module Positions in Templates → Options, then open your page with ?tp=1 appended to the URL. If the assigned position outline does not appear, the template does not output that position there – move the module to a position that is rendered.
2. Check Menu Assignment. Make sure the module is assigned to the page you are viewing.
3. View the page as a Super User. Configuration errors (bad feed, no URLs) are shown only to administrators, as a warning box. Visitors just see nothing, by design.
4. Read the module log. Problems are written to administrator/logs/mod_embed_instagram_posts.php with the exact reason (HTTP code, empty body, or “Feed contained no Instagram permalinks”).

RSS mode shows nothing

• Confirm you used the direct .xml feed URL, not the bridge’s share/preview page.
• Open the feed URL in a browser and check the items actually link to instagram.com/p/….
• Make sure your host allows outbound HTTP requests.
• Clear the module cache (or wait for Cache time to expire) after fixing the URL.

An embed shows a blank/empty box

That specific post is probably deleted, private, or region-restricted. Replace it, or switch the account/post to public.

12. FAQ

Do I need an Instagram or Meta developer account?

No. The module uses Instagram’s public embed only. There is no API key or token.

Will it show a private account’s posts?

No. Only public posts can be embedded.

How do I keep posts updating automatically?

Use RSS mode with a bridge feed. New posts in the feed appear after the cache expires.

Can I put several instances on one page?

Yes. Each module instance has its own settings and its own cache.

13. License

Embed Instagram Posts is free software released under the GNU General Public License, version 2 or later (GPLv2+); the full text is in LICENSE.txt in the package. It is provided without warranty of any kind.

Instagram is a trademark of Meta Platforms, Inc. This extension is independent and is not affiliated with, endorsed by, or sponsored by Meta; it uses only Instagram’s publicly documented embed feature.

Developed and maintained by Saint Art Designs.

Everything you need to sell your first file with PayDrop, from installation to the day-to-day work of adding products. If something is not covered here, use the contact form.

1. Installation

1. Log in to the Joomla administrator as a Super User.
2. Go to System → Install → Extensions.
3. On the Upload Package File tab, drop in pkg_paydrop.zip.

The package installs one component and three plugins, and enables all of them:

• PayDrop — the component, where your products and sales live
• System – PayDrop — guards the thank-you page, verifies payments, issues download links
• Content – PayDrop — turns the shortcode into a buy button
• Button – PayDrop — the button under the editor that inserts shortcodes

A folder called /files/ is created and closed to the web for you. If any plugin ends up disabled, enable it in System → Plugins by searching for paydrop.

2. Preparing your PayPal account

PayDrop verifies every payment with PayPal before serving a file. For that it needs a PDT identity token.

1. Sign in to paypal.com with the business account that receives payments.
2. Click the gear icon (Account Settings), then Website payments in the left menu.
3. Next to Website preferences click Update.
4. Set Auto return to On and enter any return URL. PayPal will not enable PDT without this.
5. Set Payment data transfer to On.
6. Scroll down and click Save. The token is not shown until you save.
7. Open Website preferences → Update again. The Identity Token now appears under Payment data transfer.

While you are on that page: set PayPal account optional to On if you want buyers to be able to pay by card without opening a PayPal account. Leave Encrypted website payments off — it is unrelated.

3. Options

Open Components → PayDrop → Products and click Options in the toolbar.

PayPal

• PayPal e-mail — the account that receives payments.
• PDT identity token — the token from step 2.
• Verify payments (PDT) — leave this on. With it off, anyone who knows a product token can download without paying.
• Show card form first — sends buyers straight to the card form instead of the PayPal login. Requires PayPal account optional on the PayPal side.
• PayPal sandbox — for testing with a sandbox account.

Downloads

• Files folder — where your files live. Pick it from the list; PayDrop closes it to the web by itself.
• Link lifetime (hours) — how long a download link stays valid after payment. Default 72.
• Maximum downloads — how many times one link may be used. 0 means unlimited until it expires.
• Button text — the wording on the download and buy buttons.

E-mail

• E-mail the link to the buyer — on by default, and worth keeping on.
• Subject and Message — your own wording. Placeholders: {name}, {product}, {link}, {hours}, {sitename}. Leave empty for the built-in text.

Mail matters. Set your site to SMTP in Global Configuration → Server → Mail, and make sure the From address is the same as the SMTP account. Most hosts silently reject mail when they differ, and PHP's own mail function reports success even when nothing was delivered.

4. The thank-you page

Create one ordinary Joomla article, for example titled Thank you, with a short message. This is where PayPal returns your buyers, and where the download button appears.

One article is enough for every product. It is unreachable without a valid token, so nobody stumbles onto it.

5. Adding a product

Components → PayDrop → Products → New

• Product name — shown on the PayPal checkout page.
• Thank-you article — the article from step 4.
• Upload file — upload the file you are selling. It goes into the protected folder and is selected below automatically.
• File name — or pick a file that is already in the folder.
• Product token — leave empty and a strong one is generated.
• PayPal item number — a unique id per product, for example ebook-01. Recommended: it stops a payment for a cheap product from unlocking an expensive one.
• Price and Currency.

Save. The edit screen then shows the shortcode for this product, something like Pay and Download.

6. Putting the buy button on a page

Open the article where you sell the product and either paste the shortcode, or click the PayDrop button under the editor and pick the product from the list. Nothing else is needed — price, name and return address all come from the product.

If the shortcode shows up as plain text on the page, the Content – PayDrop plugin is disabled.

7. What the buyer sees

1. Clicks the button and pays at PayPal, with an account or by card.
2. Comes back to your thank-you page. The address is cleaned of PayPal's parameters, so their name and e-mail are not left in the URL.
3. Clicks Download and gets the file.
4. Receives the same link by e-mail, valid for as long as you configured.

8. Sales

Components → PayDrop → Sales & Downloads lists every verified purchase: buyer name and e-mail, amount, PayPal transaction id, how many times the link was used, and when it expires. The three figures at the top are your totals.

9. Folder protection

PayDrop writes .htaccess, web.config and an empty index.html into your files folder, and shows the status above the product list. Green means direct downloads are blocked.

On nginx those files are ignored, and PayDrop tells you so. Add the rule to your server configuration instead:

location ^~ /files/ { deny all; }

You can check it yourself at any time: open the direct address of one of your files in a private browser window. It must return 403 Forbidden. If the file downloads, the folder is not protected.

10. Troubleshooting

The shortcode is printed as text

The Content – PayDrop plugin is disabled, or the page is cached from before you added it. Enable the plugin and clear the cache.

“Access forbidden” on the thank-you page

Expected when the page is opened without a valid token, and after PayDrop has cleaned the address. If it happens right after a real payment, check that the PayPal item number on the product matches what PayPal sent back, and that the PDT identity token is correct.

I changed the price, but PayPal still shows the old one

The buy button is part of the page HTML, so a cached page keeps the old price. Clear the cache in System → Clear Cache after changing a price, and check the page in a private browser window. The same applies when you change a product name or swap its file.

The buyer got no e-mail

Almost always the site mailer. Send a test mail from Global Configuration → Server → Mail, use SMTP, and make sure the From address matches the SMTP account. The download link is also shown on screen, so the sale is not lost.

Two buyers got the same file

This cannot happen on a current version — tokens are never written into cached HTML. If you see it, clear the Joomla cache and make sure you are on the latest release.

The download link stopped working

It expired, or it reached the download limit. Both are set in Options. You can raise the limits at any time; they apply to links issued afterwards.

11. Updates

Your purchase includes a licence key in the form SA-XXXX-XXXX-XXXX-XXXX. Enter it once:

1. Go to System → Update → Update Sites.
2. Click the PayDrop entry to open it.
3. Paste the key into the Download Key field and save.

From then on System → Update → Extensions offers new versions exactly as it does for free extensions. If no update appears after a release, click Clear Cache on that screen first — Joomla caches update sites for a while.

Without a key the check still runs, but the download is refused: the packages are not public. Your installed copy keeps working either way — a lapsed licence only stops new versions.

com_malscan — Documentation

com_malscan is a backend malware scanning component for Joomla. It scans your site's files for known malicious code patterns, tracks changes against a baseline snapshot, and lets you quarantine or restore suspicious files — all from your Joomla admin panel.

1. Installation

1. Go to System → Install → Extensions in your Joomla admin panel.
2. Upload the com_malscan_v1.3.1.zip file you received after purchase.
3. Once installed, find Malware Scanner in the left admin menu.

2. Generating a Baseline

Before your first scan, generate a baseline — a snapshot of your current file hashes, used to detect future changes.

1. Go to Malware Scanner → Core.
2. Click Generate / Reset Baseline.

Only generate a baseline when you're confident your site is currently clean — this snapshot becomes the reference point for detecting future tampering.

3. Running a Scan

1. Go to Malware Scanner → Scan.
2. Click Start Scan.
3. The scan checks your files against:
   • Known malware/webshell signatures (e.g. injected eval/base64 code, known backdoor filenames)
   • Changes against your saved baseline
   • Known vulnerable extension versions installed on your site
4. Progress is shown live; large sites are processed in batches to avoid timeouts.

4. Reviewing Findings

Go to Malware Scanner → Findings to see everything the scan flagged, with a severity rating (High / Medium) and a short description of what was matched and why.

5. Quarantine & Restore

From the Findings list, you can:

• Quarantine a file — moves it out of its live location so it can no longer run, without permanently deleting it.
• Restore a quarantined file — moves it back if it turns out to be a false positive.

6. Automatic Updates

com_malscan checks Joomla's built-in update system for new versions automatically. Update through System → Update → Extensions like any other component.

Requirements

• Joomla 4.x or 5.x
• MySQL-compatible database

Need Help?

See the product page for support contact details.

Thank You for Your Purchase!

We truly appreciate your business. Your payment has been successfully processed. You will receive a confirmation email shortly.

If you have any questions or need assistance, feel free to contact us. Enjoy your purchase!

Effective Date: [April 2025]

Welcome to Saint Art Designs. By using our website and services, you agree to comply with and be bound by the following Terms of Service. Please read these terms carefully before using our website and services.

1. Acceptance of Terms

By accessing or using the services provided by Saint Art Designs, you agree to comply with these Terms of Service and our Privacy Policy. If you do not agree with these terms, you should not use our services.

2. Services Provided

Saint Art Designs offers Joomla-based web design, development, and customization services. These services include, but are not limited to, website design, web development, website maintenance, and SEO services.

3. User Responsibilities

As a user of our services, you agree to:

• Provide accurate and up-to-date information when contacting us or using our services.
• Not engage in any unlawful activities or activities that could damage the website or its services.
• Be responsible for any content you upload, publish, or display on your website created using our services.
• Abide by all applicable local, state, and international laws when using our services.

4. Payment Terms

Payment for services is due according to the terms agreed upon in the service contract. Payments are accepted via the methods specified on our website or in the contract. Late payments may incur additional fees as specified in the service contract.

5. Client Content

You retain all rights to any content that you provide to us for use in the creation or management of your website. You grant Saint Art Designs a non-exclusive, worldwide license to use, store, and display your content as necessary for the performance of our services.

6. Intellectual Property

All designs, logos, and materials created by Saint Art Designs, including the website design and code, are the intellectual property of Saint Art Designs and may not be reproduced or used without our permission. The exception is the content you provide, for which you retain ownership.

7. Limitation of Liability

Saint Art Designs is not liable for any damages or losses resulting from the use or inability to use our website or services. We are not responsible for any indirect, incidental, or consequential damages, including data loss or interruption of business operations.

8. Privacy

Your privacy is important to us. Please refer to our Privacy Policy for details on how we collect, use, and protect your personal information.

9. Termination

We reserve the right to suspend or terminate access to our services at any time, without notice, if we believe you have violated these Terms of Service or for any other reason at our discretion. You may terminate your relationship with Saint Art Designs at any time by providing written notice. In such cases, any outstanding fees for services rendered will be due immediately.

10. Changes to Terms

We reserve the right to modify or replace these Terms of Service at any time. Changes will be posted on this page, and the “Effective Date” will be updated accordingly. It is your responsibility to review these terms periodically to stay informed about any changes.

11. Governing Law

These Terms of Service will be governed by and construed in accordance with the laws. Any disputes arising from these terms shall be resolved in the appropriate courts.

12. Contact Us

If you have any questions or concerns regarding these Terms of Service, please contact us at:

Saint Art Designs
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Effective Date: [April 2025]

At Saint Art Designs, we respect and protect your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you visit our website or use our services. By using our website, you consent to the practices outlined in this Privacy Policy.

1. Information We Collect

We may collect the following types of information:

• Personal Information: When you contact us, request services, or subscribe to our newsletter, we may collect personal details such as your name, email address, phone number, and any other information you provide.
• Usage Data: We may collect information on how you access and use our website, such as your IP address, browser type, pages visited, and time spent on the site.
• Cookies: Our website may use cookies to improve user experience. You can control the use of cookies through your browser settings.

2. How We Use Your Information

We use your personal information for the following purposes:

• To communicate with you regarding our services or inquiries.
• To improve our website and services based on your feedback and usage patterns.
• To send promotional emails or newsletters (if you have opted in).
• To process transactions and provide customer support.

3. Data Protection

We take the security of your personal information seriously. We implement appropriate technical and organizational measures to safeguard your data from unauthorized access, alteration, disclosure, or destruction. However, no data transmission over the internet is 100% secure, and we cannot guarantee the absolute security of your information.

4. Sharing Your Information

We do not sell or rent your personal information to third parties. However, we may share your information with trusted third-party service providers who assist us in operating our website, conducting business, or providing services to you. These third parties are obligated to protect your data and may not use it for any other purpose.

We may also disclose your information if required by law, to protect our rights or the safety of others.

5. GDPR Compliance

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Right to Access: You have the right to request access to the personal data we hold about you.
• Right to Rectification: You have the right to request corrections to any inaccurate or incomplete personal data we hold.
• Right to Erasure: You have the right to request the deletion of your personal data under certain conditions.
• Right to Restrict Processing: You have the right to request the restriction of processing your personal data under certain conditions.
• Right to Object: You have the right to object to the processing of your personal data under certain conditions.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used format for transfer to another organization.
• Right to Withdraw Consent: You have the right to withdraw your consent at any time, especially in relation to marketing communications.

To exercise any of these rights, please contact us at This email address is being protected from spambots. You need JavaScript enabled to view it..

6. Third-Party Links

Our website may contain links to third-party sites. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party websites before sharing your personal information.

7. Children’s Privacy

Our website is not intended for individuals under the age of 13. We do not knowingly collect personal information from children. If we discover that we have collected personal data from a child, we will take steps to delete that information.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Effective Date” at the top of this page. We encourage you to periodically review this page for any updates.

9. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:

Saint Art Designs
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.