Why Does Social Slider Feed Request Broad Meta API Permissions?

When connecting your Facebook or Instagram account to Social Slider Feed, you may notice that the plugin requests permissions such as business_management, pages_read_engagement, or instagram_basic. This guide explains why those permissions are required, what the plugin actually does with them, and how to verify everything is safe.

Meta Graph API Requirements

Meta (the company behind Facebook and Instagram) sets rules about what information third-party apps are allowed to access. Before Social Slider Feed can show a list of your Facebook Pages or Instagram accounts to choose from, Meta requires it to request a specific set of permissions upfront — regardless of whether the app reads or writes data.

In other words, Meta itself determines the minimum set of permissions any app must request in order to find your connected accounts. Social Slider Feed cannot reduce this list below what Meta requires.

The permissions you will typically see requested include:

• pages_read_engagement — read posts, likes, and check-ins on a Page
• pages_show_list — list the Pages managed by a user
• instagram_basic — read basic Instagram account info and media
• business_management — required by Meta to find and list your business-managed Pages and Instagram accounts

📝 Note: The business_management permission sounds broad, but Meta requires it solely to identify which Pages and Instagram accounts belong to your profile. The plugin does not use it to manage your business settings or ad accounts.

For the full, up-to-date list of Meta permission scopes and their descriptions, see Meta's Permissions Reference.

Plugin's Permission Usage

Social Slider Feed is a display-only plugin. Its sole purpose is to fetch your public posts and account information so it can render a feed on your WordPress site. The plugin:

• Reads post content, images, captions, and account associations to build the feed.
• Does not publish, edit, delete, or otherwise modify any content on Facebook or Instagram.
• Does not manage your ad account, business portfolio, or any other business resource.
• Does not store your access tokens on any external server — tokens are saved locally in your WordPress database.

💡 Tip: If you are unsure whether an app is acting within the permissions it was granted, you can review its activity directly in your Meta account settings (see the troubleshooting section below).

Troubleshooting Permission Concerns

If you are concerned about the permissions Social Slider Feed has been granted, use the steps below to review them and, if needed, revoke access.

Review app permissions in your Meta account

1. Log in to your Facebook account and go to Settings & Privacy > Settings.
2. In the left-hand menu, click Apps and Websites.
3. Find Social Slider Feed (or the app name shown during authorisation) in the Active tab.
4. Click View and edit next to the app entry to see exactly which permissions have been granted.

Revoke access at any time

If you decide you no longer want the plugin to have access to your accounts:

1. Follow the steps above to open the app details in Apps and Websites.
2. Click Remove to revoke all permissions and disconnect the app.

⚠️ Important: Revoking access will disconnect your feed. You will need to reconnect the plugin in your WordPress dashboard if you want to restore the feed display.

Reconnect the plugin after reviewing

If you revoked access and want to reconnect:

1. In your WordPress dashboard, navigate to the Social Slider Feed settings.
2. Click the button to reconnect your Facebook or Instagram account.
3. Follow the on-screen authorisation flow. The same permission request screen will appear — this is expected and required by Meta's API.

📝 Note: Each time you authorise the plugin, Meta will show you the full list of permissions being requested. Accepting them does not grant the plugin the ability to post or manage content — it only enables the plugin to read the data needed to display your feed.