v4.0

Upgrading is strongly recommended. In September 2026 Instagram stopped answering api/v1/users/web_profile_info/ for accounts that are signed in. Version 3.9.1 and earlier read every profile through that endpoint, so a signed-in run on those versions now fails at the first lookup of every target and cannot be fixed by re-importing the session. Version 4.0 reads profiles another way. Runs without a login are not affected.

Version 4.0 reads follower lists over less than half the Instagram requests previous versions needed. It adds follower-list sources, a daily identity budget that is on by default and an account circuit breaker with recovery after session repair. Setup now asks what to collect before asking where to read it from. It also adds private SMTP password entry, clearer Doctor checks and quieter diagnostics, with stronger protection for saved history and credentials. Signed-in monitoring keeps working after Instagram retired the profile endpoint earlier versions depended on. Alert delivery messages stay within the correct check report and alert channels that still use placeholder configuration values are shown as not configured.

Features and improvements:

• NEW: Follower lists over fewer requests - FOLLOW_LIST_SOURCE = "auto" reads lists over REST, which returns 25 accounts per request instead of the 12 the GraphQL queries returned, so a list of 1,000 accounts costs 40 requests instead of 84. GraphQL is retried only for missing or unreadable endpoints. Select graphql or rest explicitly if needed. Lists require a logged-in session and challenges or rate limits never trigger fallback
• NEW: Experimental browser source - FOLLOW_LIST_SOURCE = "browser" requires the playwright extra and an installed browser. It is slower and never selected automatically. Read the browser-source limitations. Thanks to @tomballgithub for validation and feedback
• NEW: Daily identity budget - IDENTITY_BUDGET_PER_DAY limits follower and following name fetching across targets until local midnight. It defaults to 2000, which covers one full follower and following scan of a typical account with room to repeat it. Counts and other activity continue when exhausted and incomplete lists never replace saved history.
• NEW: Account circuit breaker - Enabled by default, CIRCUIT_BREAKER stops all targets using an account after a confirmed challenge, checkpoint or expired session. Fix the account issue and restart or re-import the session to check recovery.
• NEW: Profile URLs as targets - A target may now be a complete profile URL such as https://www.instagram.com/someuser/, in the setup wizard, on the command line and in TARGET_USERNAMES. It is stored as the username.
• NEW: Exposure report - --exposure shows identity usage, failure categories and circuit-breaker state without account names, target names or local paths. It also reports whether the ledger exists yet and whether this run could save it, how much of the daily budget is left and that it resets at local midnight, how many other accounts share the file and how many of them are stopped
• NEW: Private SMTP password setup - --set-smtp-password takes a hidden password and checks it with the mail server before saving. Guided setup also checks email credentials without sending a message
• IMPROVE: Setup and Doctor improvements - Setup preserves saved settings, lets you skip unavailable answers and offers log, CSV and alert choices. Choosing an existing Instaloader session now checks that a session file for that account exists. It also asks whether to collect followers and following, followers only, or counts only with no names, and asks where to read them from only when it will read them.
• IMPROVE: Clearer browser session import - The profile list in setup and on the Web Dashboard marks the profiles signed in to Instagram with *, and defaults to the signed-in one when there is only one. The setup login menu also reports which browsers have a signed-in profile at all, before you choose one.
• IMPROVE: Fewer lookups after a restart, and the daily name cap is asked for - A target's Instagram user id is now written beside the other state files and reused by later runs, so an established target is not looked up again on every start. An id is dropped and resolved again if Instagram reports a different name for it, which is what happens when a username is freed and taken by someone else. A target that is the signed-in account itself takes its id from the session and is never searched for (thanks @VecToR-1024, from #135)
• IMPROVE: Reels can be left alone, and are by default - The endpoint Instagram reports a reel count with has become unreliable, failing regardless of the account or the IP address, and the only way left to get the count is to read the target's whole reel list. Reels are therefore no longer monitored by default. Posts and stories are unaffected, and a reel still counts towards the posts number, so a new reel moves that. Turn reels back on with FETCH_REELS, --fetch-reels, the Web Dashboard or the question --setup now asks, and expect repeated errors on the checks Instagram refuses
• IMPROVE: Reels counts are not recounted every cycle - Instagram stopped answering the endpoint that reports a target's reels count, so the count is worked out by reading the whole reel list. That list is now read again only when the target's posts count moves, which a new reel does
• IMPROVE: Quieter diagnostics and notifications - --verbose reports events and --debug adds technical traces with secrets redacted. Persistent outages produce hourly reminders and recovery notices instead of repeated errors. Set DELIVERY_CONFIRMATIONS = False to hide delivery confirmations while keeping verbose diagnostics.
• IMPROVE: TLS and terminal output - VERIFY_SSL covers outbound certificate checks, including email. Verification is on by default and disabling it produces a warning. --truncate N limits screen width while logs retain full lines. It works without wcwidth, which improves Unicode width measurements.
• IMPROVE: Failure alerts share one shape - Every monitoring failure email and webhook uses the subject Instagram Monitor error: <what went wrong> (user: <target>) and lists the fix, the guide link, how many checks failed in a row, since when and when the next retry happens. A recovery alert follows on the channels that received the failure alert once monitoring resumes. -e / --no-error-notify and --no-webhook-error-notify switch both off

Bug fixes:

• BUGFIX: Signed-in monitoring works again after Instagram retired a profile endpoint - In September 2026 Instagram stopped answering api/v1/users/web_profile_info/ for accounts that are signed in, replying 400 feedback_required however healthy the account was. Every signed-in run failed at the first profile lookup. A signed-in run now resolves the target through Instagram's search and reads the profile over GraphQL, which the same session answers normally. Each target's id is resolved once and reused for the rest of the run. The retired endpoint is still tried for a target search cannot list, and its refusal is now reported as endpoint_retired, which does not stop the account or trip the circuit breaker. Runs without a login were never affected and are unchanged (thanks @VecToR-1024 for an independent fix and validation in #135)
• BUGFIX: Flagged sessions caught across requests - Challenges and feedback requirements during story, post or follower-list requests now pause other targets and trigger account recovery handling, as profile failures do. Fixes #131
• BUGFIX: Firefox from the Microsoft Store is found on Windows - Session import searched only %APPDATA%\Mozilla\Firefox\Profiles, so a machine whose only Firefox came from the Store was told no cookies.sqlite was found. It now also searches the Store package's profile folder under %LOCALAPPDATA%\Packages, follows a redirected APPDATA or LOCALAPPDATA, and lists those profiles as Microsoft Store so the default-release both installs create can be told apart. Container imports mount a single fixed path and still cover the regular installer only (thanks @VecToR-1024, from #134)
• BUGFIX: Story viewing warnings - Stories loaded at startup now carry the same anonymity warning as newly detected stories in both dashboards. The Web Dashboard also warns for older story records and requires confirmation before opening a story, including with a middle-click. Downloaded images offer View Media instead of a broken video control. Play Video uses downloaded videos only.
• BUGFIX: Alert deliveries stay inside their report - The hourly Monitoring degraded reminder closed its report before the error alert was sent, so Sending email notification to ... and its webhook equivalent landed under the separator and started a second, headless block. The reminder now closes below its delivery lines, keeping one check's report in one block
• BUGFIX: Windows Docker Firefox import finds the profiles - The Windows container commands mounted %APPDATA%\Mozilla\Firefox, one level above the Profiles folder the container looks in, so the import reported no cookies.sqlite was found. The commands now mount %APPDATA%\Mozilla\Firefox\Profiles, and a container given the old path still finds the profiles, so a command already saved in a script keeps working
• BUGFIX: Protected follower history - Malformed follower and following records are reported before replacement. Correct the named file or move it aside to start fresh
• BUGFIX: Safer configuration and secret updates - Configuration replacement creates a backup when a filename is passed. Shell redirection bypasses this protection. Setup preserves retained credentials when changing destinations and keeps inline secrets out of configuration backups.
• BUGFIX: Safer notification delivery - Webhook retries keep their original destination and credentials. Discord templates cannot enable mentions and invalid templates are rejected before delivery. Error messages redact credentials, including SMTP rejection replies.
• BUGFIX: Readable ntfy alerts - ntfy notifications arrive as plain text. The bold markers, the backslashes in follower and following names and the brackets around links are gone, since no ntfy client renders the Discord markdown they came from. Discord alerts are unchanged
• BUGFIX: Reported changes name the window they were observed in - The Check interval: line under a change was built from the randomized interval the run was about to sleep, not from the time that had passed, so a change found after a failed check or outside the monitoring hours was reported over a window the tool had not been watching. It now measures from the previous successful check

Security and privacy:

• SECURITY: Private follow-analysis errors - Unexpected Web Dashboard analysis failures no longer return local file details. Use --debug to see the diagnostic locally
• SECURITY: Container security updates - Published rebuilds refresh Debian security updates instead of reusing cached package layers

Smaller fixes and development changes are listed in the full change history.