Title: Zware Automatic Social Posts and Login Author: zwareonline Published: जून 30, 2026 Last modified: अक्टूबर 2, 2026 --- Search plugins ![](https://ps.w.org/zasp-zware-automatic-social-posts-and-login/assets/banner-772x250. png?rev=3591055) ![](https://ps.w.org/zasp-zware-automatic-social-posts-and-login/assets/icon-256x256. png?rev=3591055) # Zware Automatic Social Posts and Login [zwareonline](https://profiles.wordpress.org/shinji3rd/) लिखले बारे [डाउनलोड](https://downloads.wordpress.org/plugin/zasp-zware-automatic-social-posts-and-login.1.1.4.zip) * [Details](https://bho.wordpress.org/plugins/zasp-zware-automatic-social-posts-and-login/#description) * [समीक्षा](https://bho.wordpress.org/plugins/zasp-zware-automatic-social-posts-and-login/#reviews) * [Installation](https://bho.wordpress.org/plugins/zasp-zware-automatic-social-posts-and-login/#installation) * [Development](https://bho.wordpress.org/plugins/zasp-zware-automatic-social-posts-and-login/#developers) [मदद](https://wordpress.org/support/plugin/zasp-zware-automatic-social-posts-and-login/) ## बिबरन **Publish once, share everywhere.** Zware Automatic Social Posts and Login (ZASP) is a plugin that does two things: 1. **Auto-posts to social networks** the moment you hit Publish — Facebook, Instagram, X (Twitter), Threads, Bluesky, Mastodon, and Truth Social are included in the free version. 2. **Adds social login buttons** to your WordPress login and register pages so users can sign in with Facebook, Google, Apple, X, Twitch, or Discord in one click. #### 📢 Social Auto-Posting Connect your accounts once and ZASP handles publishing automatically: * **Facebook Pages** — posts with image and link preview via the Meta Graph API. * **Instagram Business/Creator** — image posts with automatic aspect-ratio adjustment( 4:5, 1:1, 1.91:1). Your original image is never modified — ZASP creates a temporary copy, uploads it, and deletes it immediately. * **X / Twitter** — tweets up to 280 characters with optional image, using OAuth 2.0 PKCE with automatic token refresh. * **Threads** — posts via the Meta Threads Graph API. * **Bluesky** — posts via the AT Protocol using app passwords. * **Mastodon** — posts to any Mastodon instance with automatic app registration. * **Truth Social** — posts via the Mastodon-compatible Truth Social API. **Per-post share controls** — the post editor includes a ZASP panel where you can share to each connected network individually and see the last share status per network. **Stable token storage** — access tokens are stored encrypted in a dedicated database table using libsodium when available. A weekly health check verifies Facebook/Instagram token validity. X tokens auto-refresh before expiry. #### 🔑 Social Login Let your visitors skip the registration form: * **Facebook** — one-click login/register via Facebook OAuth 2.0. * **Google** — sign in with Google (OpenID Connect). * **Apple** — Sign in with Apple, including first-name/last-name capture on first login. * **X (Twitter)** — login via X OAuth 2.0 PKCE. * **Twitch** — login via Twitch OAuth 2.0. * **Discord** — login via Discord OAuth 2.0. Three button styles: default (icon + text), rounded, and icon-only. OAuth callbacks use WordPress REST API endpoints (`/wp-json/zasp/v1/login/{network}/ callback`) for compatibility with caching plugins. **User creation:** Social login creates WordPress user accounts using standard WordPress functions (`wp_create_user`, `wp_set_auth_cookie`). New accounts are assigned the role configured in Settings Login Social (default: Subscriber). Apple identity tokens are verified against Apple’s public keys before any account is created or accessed. It is strongly recommended to set the default role to Subscriber and to restrict registration via the site’s General Settings if you do not wish to allow open registration. #### ⭐ ZASP Premium Expand to more platforms with the **ZASP Premium** add-on (available at [zwareonline.com](https://zwareonline.com)): * **LinkedIn** — post to personal profiles and company pages. * **Pinterest** — create Pins on any board. * **Auto-Scheduler** — queue posts to go out at configured times instead of publishing immediately, checked every 15 minutes. * **Reshare Evergreen** — automatically reshare older posts on a daily schedule, with configurable time, day-of-week filters, category/tag filters, and per-post exclusion. * **Missed-schedule recovery** — if WordPress misses a scheduled share, ZASP Premium catches and retries it. * **Priority email support.** #### External Services This plugin connects to the following external services. Data is only sent when you or your users explicitly trigger the relevant action (connecting an account, publishing a post, or logging in). **Meta / Facebook Graph API** (`https://graph.facebook.com`, `https://graph.threads. net`) Used to publish posts to Facebook Pages, Instagram Business/Creator accounts, and Threads. Called when: (a) you connect a Facebook, Instagram, or Threads account;( b) a post is published and auto-posting is enabled; (c) you share manually from the post editor. Data sent: your Facebook Page access token, post title, post content/ excerpt, post URL, and featured image (if any). [Meta Terms of Service](https://www.facebook.com/terms)· [Meta Privacy Policy](https://www.facebook.com/policy) **X / Twitter API** (`https://api.twitter.com`, `https://twitter.com/i/oauth2`) Used to post tweets and to authenticate your X account via OAuth 2.0 PKCE. Called when: (a) you connect your X account; (b) a post is published and auto-posting is enabled; (c) you share manually; (d) a user logs in with X. Data sent: your X OAuth credentials, post content, and (optionally) the featured image. [X Terms of Service](https://twitter.com/en/tos)· [X Privacy Policy](https://twitter.com/en/privacy) **Bluesky / AT Protocol** (`https://bsky.social`) Used to post to Bluesky using app passwords. Called when a post is published and auto-posting is enabled, or when you share manually from the post editor. Data sent: your Bluesky handle, app password( used to obtain a session token), post content, and (optionally) the featured image. [Bluesky Terms of Service](https://bsky.social/about/support/tos) · [Bluesky Privacy Policy](https://bsky.social/about/support/privacy-policy) **Mastodon (user-configured instance)** Used to post to the Mastodon instance you configure. Called when a post is published and auto-posting is enabled, or when you share manually. The specific API domain depends on your configured instance ( e.g., `https://mastodon.social`). Data sent: your Mastodon instance URL, OAuth credentials, post content, and (optionally) the featured image. [Mastodon Privacy Policy](https://mastodon.social/privacy-policy)( varies by instance) **Truth Social** (`https://truthsocial.com`) Used to post to Truth Social via its Mastodon-compatible API. Called when a post is published and auto-posting is enabled, or when you share manually. Data sent: your Truth Social OAuth credentials, post content. [Truth Social Terms](https://truthsocial.com/terms-of-service) · [Truth Social Privacy Policy](https://truthsocial.com/privacy-policy) **Google OAuth2** (`https://accounts.google.com`) Used to sign users into your WordPress site via Google (OpenID Connect). Called only during a user login/registration flow initiated by the user. Data sent: your Google OAuth2 Client ID and Client Secret. Google returns the user’s name, email, and profile picture URL, which are stored in your WordPress database. [Google Terms of Service](https://policies.google.com/terms)· [Google Privacy Policy](https://policies.google.com/privacy) **Apple ID** (`https://appleid.apple.com`) Used to sign users into your site via Sign in with Apple. Called only during a user login/registration flow. Data sent: your Apple Services ID and team credentials. Apple returns a signed identity token containing the user’s name and email, which are stored in your WordPress database. [Apple Terms of Service](https://www.apple.com/legal/internet-services/itunes/us/terms.html)· [Apple Privacy Policy](https://www.apple.com/legal/privacy/) **Twitch API** (`https://api.twitch.tv`, `https://id.twitch.tv`) Used to sign users into your site via Twitch OAuth 2.0. Called only during a user login/registration flow. Data sent: your Twitch Client ID and Client Secret. Twitch returns the user’s display name and email, which are stored in your WordPress database. [Twitch Terms of Service](https://www.twitch.tv/p/en/legal/terms-of-service/)· [Twitch Privacy Policy](https://www.twitch.tv/p/en/legal/privacy-policy/) **Discord API** (`https://discord.com/api`) Used to sign users into your site via Discord OAuth 2.0. Called only during a user login/registration flow. Data sent: your Discord Client ID and Client Secret. Discord returns the user’s username and email, which are stored in your WordPress database. [Discord Terms of Service](https://discord.com/terms)· [Discord Privacy Policy](https://discord.com/privacy) No data is ever sent to Zware Online servers by this plugin. #### Privacy ZASP stores access tokens and user data (names, emails, social network UIDs) in your own WordPress database. No data is transmitted to Zware Online or any third party beyond the social network services listed above and as described in each service’s entry. ### Support For support, visit [zwareonline.com](https://zwareonline.com) or email support@zwareonline. com. ## Screenshots [⌊Login Social tab — configure social login buttons (Facebook, Google, Apple, X, Twitch, Discord).⌉⌊Login Social tab — configure social login buttons (Facebook, Google, Apple, X, Twitch, Discord).⌉[ Login Social tab — configure social login buttons (Facebook, Google, Apple, X, Twitch, Discord). [⌊Facebook tab — app credentials and auto-post settings with connection status.⌉⌊ Facebook tab — app credentials and auto-post settings with connection status.⌉[ Facebook tab — app credentials and auto-post settings with connection status. [⌊Post editor panel — per-network share buttons with last-share status.⌉⌊Post editor panel — per-network share buttons with last-share status.⌉[ Post editor panel — per-network share buttons with last-share status. [⌊Guide tab — full reference of all free and premium features.⌉⌊Guide tab — full reference of all free and premium features.⌉[ Guide tab — full reference of all free and premium features. [[ ## Installation 1. Upload the plugin folder to `/wp-content/plugins/`, or install via **Plugins Add New**. 2. Activate the plugin. 3. Go to **Social & Login** in the WordPress admin menu. 4. Configure the credentials for each social network or login provider you want to use. 5. Connect your accounts using the Connect buttons in each network tab. 6. Done — ZASP will share new posts automatically and show social login buttons on your login page. ## FAQ ### Does this work with caching plugins? Yes. OAuth callbacks use WordPress REST API endpoints (`/wp-json/zasp/v1/…`) which are excluded from page caches in most caching plugins. Session cookies are set server- side after login, so caching does not interfere with authentication. ### Why does Instagram require a Business or Creator account? Meta’s Graph API only allows automated publishing to Instagram Business or Creator accounts. Personal accounts cannot be used for automated posting. You can convert a personal account to a Creator account at no cost in Instagram’s settings. ### My Facebook token keeps getting revoked. What do I do? ZASP uses long-lived Page access tokens. Common causes of revocation: changing your Facebook password, removing the app from your Facebook account security settings, or Meta revoking it due to a policy violation. ZASP will notify you when a token becomes invalid and you can reconnect in one click from the Settings page. ### Can I post to multiple Facebook pages? Yes. All Pages accessible from your Facebook account are stored when you connect. You can switch the active page from Settings Facebook. ### Does ZASP modify my images? No. When Instagram requires an aspect-ratio adjustment, ZASP creates a temporary copy of the image, uploads it to Instagram, and then immediately deletes the temporary file. Your original featured image is never modified. ### Where are social login users stored? In your WordPress user database, the same as any user registered through any other method. Social login matches existing accounts by email address first, then by network UID. If a matching email already exists the user is logged in — no duplicate account is created. ### Can I restrict which roles social login assigns? Yes. Go to Settings Login Social Default Role and choose the role assigned to new accounts created through social login. It is recommended to use Subscriber ( the default) unless your site has a specific need for higher-privileged self-registration. ## समीक्षा There are no reviews for this plugin. ## Contributors & Developers “Zware Automatic Social Posts and Login” is open source software. The following people have contributed to this plugin. Contributors * [ zwareonline ](https://profiles.wordpress.org/shinji3rd/) [Translate “Zware Automatic Social Posts and Login” into your language.](https://translate.wordpress.org/projects/wp-plugins/zasp-zware-automatic-social-posts-and-login) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/zasp-zware-automatic-social-posts-and-login/), check out the [SVN repository](https://plugins.svn.wordpress.org/zasp-zware-automatic-social-posts-and-login/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/zasp-zware-automatic-social-posts-and-login/) by [RSS](https://plugins.trac.wordpress.org/log/zasp-zware-automatic-social-posts-and-login/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.4 * Bug fix: The Guide tab showed the wrong OAuth callback URL for Facebook, Instagram, X (Twitter), Threads, Mastodon and LinkedIn (a REST address that does not exist). New installs following the guide would get a “redirect URI mismatch” when connecting. The guide now shows the exact callback URL each network uses. * Cleanup: Removed the old, unused per-network settings screens (replaced long ago by the Networks tab and its modals) and an unused Facebook REST route that pointed to a missing handler. #### 1.1.3 * Bug fix: Auto-sharing on publish now runs in the background a few seconds after the post is saved, instead of inside the publish request. With the block editor the featured image, categories/tags and the ZASP meta box fields are saved after the publish event fired, so manually published posts were shared without image( Facebook, Threads) or failed outright (Instagram, Pinterest), and per-post custom messages or network opt-outs were ignored. It also no longer slows down or times out the publish request. * Bug fix: Threads now waits for Meta to finish processing the media container before publishing, and checks whether the post was actually published before reporting a failure. Fixes posts reported as failed that were in fact published( and published without their image). * Bug fix: Instagram verifies the container status when media_publish errors or times out, so a post that Meta did publish is no longer reported as failed or retried. * Improvement: One network failing can no longer stop the remaining networks from being shared during auto-share. * Improvement: The post editor panel shows a “sharing in the background” notice and refreshes itself until all networks have finished; failed shares now show the reason. * Improvement: Fixed the editor panel refresh nesting a copy of the panel inside itself. #### 1.1.2 * Bug fix: WebP images (and other formats not accepted by social APIs) are now automatically converted to JPEG before sharing. Applies to Instagram, Facebook, Threads, LinkedIn, Pinterest, and Truth Social. X (Twitter), Bluesky, and Mastodon accept WebP natively and are not affected. The conversion uses the same temporary file approach as the Instagram aspect-ratio crop: a JPEG copy is created in wp- content/uploads/zasp-media/, used for the share, then deleted immediately. * Improvement: Instagram’s prepare_for_instagram() now applies format conversion before the aspect-ratio check, so a WebP with wrong ratio is both converted and cropped in a single pass without leaving intermediate temp files. #### 1.1.1 * Bug fix: Image captions (figcaption, wp-caption, [caption] shortcode) are now stripped from post content when sharing with the “Full content” option. Captions read as disconnected text in social posts because the image they describe is not included. #### 1.1.0 * Security: Apple Sign In now performs full RS256 cryptographic signature verification against Apple’s public JWKs (cached 24 h). Handles key rotation with automatic retry. * Security: Social login email matching is now gated on provider email verification flags (Google email_verified, Discord verified, Apple email_verified JWT claim). Unverified emails are cleared before account lookup to prevent account takeover. * Security: New accounts created via social login are always assigned the Subscriber role. The configurable role selector has been removed. * Security: Social login respects the site’s “Anyone can register” setting. * Bug fix: Instagram publishing now stores the media container_id in post_meta after Step 1 succeeds. Scheduler retries reuse the existing container instead of creating a new one, preventing orphaned containers and intermittent publish failures. * Bug fix: Instagram container polling extended to 6 polls × 5 s (30 s total) to handle slower Meta image processing. Timeout failures are now retryable without losing the container reference. * Bug fix: Duplicate auto-shares on scheduled posts fixed. The premium scheduler’s publish_future_post hook (which re-queued every scheduled post regardless of whether on_publish had already handled it) has been removed. wp_scheduled_missed is retained for genuinely missed schedules only. * Bug fix: X (Twitter) token refresh now correctly preserves the stored username label (_label key) when saving the refreshed token. Label was previously lost on every 2-hour refresh cycle, causing the account card to show a numeric ID. * Bug fix: X token get() no longer filters expired tokens when queried by account_id. The caller needs the refresh_token even after the access_token has expired. * Bug fix: X token is now saved with expires_in at initial connection, enabling proactive refresh before the API call instead of reactive refresh after a 401. * Bug fix: X publish() now performs a proactive token refresh if the access_token expires within 5 minutes, eliminating the 401 refresh retry round trip in normal operation. * Bug fix: X has_valid() now considers any stored row as connected (expired or not), preventing false “Conectar” state when the token is merely stale but refreshable. * Bug fix: X refresh failure on HTTP 400/401/403 or invalid_grant now deletes the stored token so the card correctly shows “Conectar” instead of a broken connected state. * Bug fix: Facebook profile picture URLs are now stored as stable Graph API redirect URLs (graph.facebook.com/{id}/picture?type=large) instead of expiring CDN URLs. * Bug fix: Instagram profile picture is now fetched and stored at connect time. * Bug fix: wp_localize_script for the post editor metabox now includes refresh_nonce, fixing the auto-refresh after publish (the AJAX call was silently rejected because the nonce was undefined). * Bug fix: Metabox auto-refresh after publish no longer checks isDirty, which was always true during a first-time Publish and prevented the refresh from ever firing. * Bug fix: Delete queue item handler replaced sanitize_key() with sanitize_text_field() - regex validation to preserve dots in uniqid() keys (sanitize_key was stripping dots, making the key not match the stored queue entry). * Bug fix: Instagram OAuth state now uses zasp_create_oauth_state() (HMAC-signed) instead of a random UUID transient, fixing a state mismatch that made Instagram callbacks fail. * Bug fix: Token Store get() no longer excludes expired tokens when queried by specific account_id; the ORDER BY in the no-account_id path now prefers non- expired rows but falls back to the most recently updated row. * Improvement: Weekday selector added to Evergreen Republish settings (Programador tab). The reshare cron runs daily but only queues posts on selected days. * Improvement: Social login page now shows the exact Social Login buttons rendered by ZASP. #### 1.0.0 * Initial release. * Free: Social Login with Facebook, Google, Apple, X, Twitch, Discord. * Free: Auto-post to Facebook, Instagram (with smart crop), X, Threads, Bluesky, Mastodon, Truth Social. * Free: Per-post instant share and per-network share controls from the post editor. * Encrypted token storage with libsodium. * Weekly Facebook/Instagram token health check. * X OAuth 2.0 PKCE with automatic token refresh. ## मेटा * Version **1.1.4** * Last updated **1 week पहिले** * Active installations **30+** * WordPress version ** 6.2 चाहे एकरो से ऊपर ** * Tested up to **7.1.3** * PHP version ** 8.0 चाहे एकरो से ऊपर ** * Language * [English (US)](https://wordpress.org/plugins/zasp-zware-automatic-social-posts-and-login/) * Tags * [auto post](https://bho.wordpress.org/plugins/tags/auto-post/)[facebook](https://bho.wordpress.org/plugins/tags/facebook/) [Instagram](https://bho.wordpress.org/plugins/tags/instagram/)[social login](https://bho.wordpress.org/plugins/tags/social-login/) [social media](https://bho.wordpress.org/plugins/tags/social-media/) * [Advanced View](https://bho.wordpress.org/plugins/zasp-zware-automatic-social-posts-and-login/advanced/) ## रेटिंग्स No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/zasp-zware-automatic-social-posts-and-login/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/zasp-zware-automatic-social-posts-and-login/reviews/) ## Contributors * [ zwareonline ](https://profiles.wordpress.org/shinji3rd/) ## मदद Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/zasp-zware-automatic-social-posts-and-login/)