About this plugin
Connect with OAuth.
More information: Auto Poster for Pixelfed.
- Enable selected category rules.
- Use content images, with featured-image fallback.
- Set captions with {{title}}, {{permalink}}, {{excerpt}}, {{category}} and {{date}}.
- Use alt templates or existing image alt text.
- Choose public/private visibility per rule.
- Use duplicate prevention, Post now or Force repost.
- Check the account and optionally store API responses/errors.
Automatic posting follows saving a published post without a password and its categories. The first enabled matching category rule wins, from top to bottom. Duplicate prevention skips a stored Pixelfed status ID.
Local attempt records reduce overlapping posts. Uncertain results block automatic posting, Post now and Force repost until review by an authorized post editor. Exactly-once delivery is not guaranteed; no server-side idempotency support is assumed.
Posting requires confirmed autocommit storage on a supported connection. Active host transactions or unknown connections block posting; the plugin does not commit host transactions.
Up to 20 images per attempt, each at most 10 MiB: JPEG, PNG, GIF, WebP or AVIF when core/PHP recognizes the file. 5 and a suitable host. Instance limits apply; no added compression.
Not affiliated with or endorsed by Pixelfed.
External services
Use an account on a compatible, publicly reachable HTTPS Pixelfed instance. Your instance provides authorization, image hosting and publication.
Installation and activation do not contact Pixelfed. Authorize with Pixelfed registers an application on the saved instance with the app name, site URL, callback URL and read/write scopes. Your browser opens its consent screen.
The returned code is exchanged for a token using the app credentials.
The read scope checks the account; write uploads images and creates posts. Account verification returns the account name/profile URL and may run for an unverified connection in settings or via Check connected account. Posting sends files, filenames, media types, alt text, captions, visibility and media IDs.
Protected requests use the access token. The instance receives server IP/connection metadata; your browser connects there for authorization.
External public HTTPS image hosts receive the requested URL and your server’s connection metadata. Images are downloaded to temporary files, uploaded to Pixelfed and locally cleaned up after the attempt. API and image requests do not follow redirects; use direct URLs.
No analytics/tracking is sent to the developer.
Instances are independently operated. Review your chosen instance’s terms and privacy policy before authorizing. social:
- Pixelfed documentation
- pixelfed.social terms of use
- pixelfed.social privacy policy
- pixelfed.social community guidelines
social, not automatically to other instances. Review the instance’s rules for automated posting and use content you are entitled to publish. social removes excessive advertising and uncurated third-party news bots from its public timeline.
Shared content may be distributed to other Fediverse servers according to its visibility and federation behavior.
Privacy and stored data
st_pixelfed_settings stores settings, client ID/secret, token, account name/profile URL and category rules; callback state, administrator ID and session hash verify OAuth. Credentials are not encrypted by the plugin; protect your database/backups.
Posts store the Pixelfed status ID/URL in metadata for the editor and duplicate prevention. st_pixelfed_attempt_<post-id> options store attempt ID, phase/reason, start/expiry times, original instance/account, content/payload/legacy/review hashes and status ID/URL. No raw tokens or post content are stored in these records.
Debug is off by default. It stores the latest attempt time, API response/error in post metadata, keeping only the last media response. JSON above 64 KiB is shortened.
Known credential keys and stored token/secret values are redacted; account, media, caption and other personal data may remain. Review before sharing. log.
Debug off preserves old data. Disconnect locally clears client ID/secret, token, authorization state and account; rules/preferences remain. Instance changes clear credentials; canceling OAuth keeps the existing connection.
Local disconnect does not revoke remote permissions: remove the app in your instance’s authorized-app settings.
Deactivation/deletion retains settings, attempt records and post metadata. Records have no scheduled erasure; pre-status failures may clear their record; other records persist until a later attempt replaces them or manual erasure. Administrators can remove st_pixelfed_settings, st_pixelfed_attempt_ options and _st_pixelfed_ post metadata using database/WordPress tools.
Pause posting and check unresolved outcomes before erasing records. Local deletion does not delete remote posts.
Source code
The package includes the maintained, human-readable PHP, JavaScript and CSS sources and a translation template (POT). Translated PO/MO catalogs are not bundled; WordPress manages language packs separately. JavaScript and CSS are used directly; no compilation, minification, transpilation or external build service is required.