Facebook and Instagram are dropping unauthenticated oEmbed support on October 24. WordPress will be removing both Facebook and Instagram as oEmbed providers in an upcoming release. After evaluating third-party solutions, WordPress VIP is recommending its partners enable Jetpack’s Shortcode Embeds module. Jetpack will be shipping the update in its 9.0 release, which is anticipated to land prior to the October 24th deadline.
The module is being updated to provide a seamless transition for users who might otherwise be negatively impacted by Facebook’s upcoming API change. WordPress contributors have run some simulations but are not yet sure what will happen to the display for previously embedded content.
“It is possible that they change the contents of the JS file to manipulate cached embeds, perhaps to display a warning that the site is using an old method to embed content or that the request is not properly authenticated,” Jonathan Desrosiers commented on the trac ticket for removing the oEmbed providers.
WordPress.com VIP roughly outlined what users can expect if they do not enable a solution to begin authenticating oEmbeds:
By default, WordPress caches oEmbed contents in post metadata. These embeds will continue to display in previously-published content. If you edit older posts in the Block Editor, regardless of whether you update the post by saving changes, the embeds in the post will no longer be cached and will stop displaying. If you view these older posts using the Classic Editor, so long as the post is not re-saved, the embeds will continue to function and display properly. If you update the post content, the embed will cease functioning unless you have a mitigation installed.
Although WordPress VIP recommends using the Jetpack module as the best solution, self-hosted WordPress users may want to investigate other options if they are not already using Jetpack. oEmbed Plus is a free plugin created specifically for solving the problem of WordPress dropping Facebook and Instagram as oEmbed providers but it is more work to set up and configure. It requires users to register as a Facebook developer and create an app to get API credentials.
This is great. Take something that was working before and remove it (albeit with good reason) without any fallback – but then add the new version that does work into JetPack to get people to install that bloatware…
If it’s possible in JetPack, why isn’t it possible in WordPress core any longer?