Solved – I have a caching plugin called Swift Performance, which also has a “plugin organiser” that allows access rules to be created for plugins, to avoid bloat where they are not needed.
At some point, I must have added Instant Images to this, to block Front-End access (thinking the plugin is only needed on the back-end).
However, removing this rule has fixed the issue.
thank you
Alan