CAPI Suite: Meta Pixel, Pinterest & TikTok for WooCommerce

Meta Pixel, Pinterest and TikTok, sent server-side, in one free plugin. A bundled Google Tag Manager template covers browser-side tracking. Sixteen events you switch on individually — PageView, ViewContent, ViewCategory, SelectItem, AddToCart, ViewCart, InitiateCheckout, AddShippingInfo, AddPaymentInfo, Purchase, Search, CompleteRegistration, AddToWishlist, Lead, Login and Comment — plus subscription renewals handled on their own terms. Classic and block-based checkout, HPOS compatible, each platform retried independently on failure. No cloud server to rent, no premium tier to unlock, no event limit. Your match quality climbs on its own after you update. Twenty identity parameters are assembled per event and normalised exactly the way Meta requires before they are hashed. The hashed keys are then remembered for up to 180 days behind a consent gate, so a returning visitor arrives already identified instead of anonymous. Nothing raw is ever written to disk: only salted SHA-256 hashes, which survive even a WordPress security-key rotation. Attribution survives the whole journey, not just the click. Eight click identifiers are captured and kept — fbclid, gclid, wbraid, gbraid, ttclid, pina_id, _epik and _ttp — written into first-party cookies client-side so a cached landing page never loses them, then persisted onto the order so a payment that completes days later is still credited to the campaign that earned it. Subscription renewals inherit the original order's identifiers instead of being credited to a fresh ad. Bots don't get counted as customers — and real shoppers on a VPN still are. Datacenter ranges are weighed against actual browser behaviour: mouse movement, scrolling, and whether a cart ever appears. A doubtful visit is held rather than thrown away, and if that visitor goes on to act like a real person, the whole funnel is released and reported retroactively. Purchases are never held back while any of this is decided. Apple iCloud Private Relay and corporate VPN egress ranges are recognised as real people, not as datacenters. Safari visitors stay attributable for 90 days, not 7. The cookie is written by the server, so Safari's seven-day cap on script-written cookies stops resetting the visitor every week. Your orders are counted once, not twice. The same event ID goes out browser-side and server-side within Meta's 48-hour deduplication window, so each platform matches them up instead of double-counting. A browser event that falls outside the window is suppressed rather than sent as a second conversion. You keep your analytics when a visitor declines cookies. The event still goes through for counting, with personal details stripped out first. Five consent platforms are recognised automatically — CookieYes, Cookiebot, Complianz, iubenda and Termly — and a filter covers anything else, including OneTrust, Usercentrics and hand-rolled banners. Built like infrastructure, not like a tracking snippet

• Nothing is lost when a platform has a bad minute. Events queue and retry per platform: if Meta accepts an event and Pinterest times out, only Pinterest is retried. Dispatch runs on Action Scheduler rather than WP-Cron, so a stalled queue is visible and recoverable instead of silent.
• Built for shared hosting. Counters are incremented atomically in SQL rather than read-modify-written, so overlapping requests cannot lose each other's work. The bot blocklist is stored as roughly 10,000 pre-computed numeric ranges queried through a database index, not as a text list parsed on every request.
• The REST endpoint is not an open door. Events are signed with a rotating HMAC token, nonce-verified where a form is involved, and rate-limited per IP — with the limiter backed by a database table so it still works on hosts with no object cache.
• A bundled GTM template gets your browser-side tags running in minutes. 37 tags, 12 triggers and 17 variables covering GA4, Meta Pixel, TikTok Pixel, Pinterest Tag and Google Ads, with Conversion Linker already attached — normally an afternoon of manual GTM work. A written manual is included for anyone who would rather build it by hand.
• You can see exactly what was sent, and undo a bad exclude. The Event Log shows the identity parameters that went out with each event and the platform's own response. Its By-IP view groups repeat traffic together, flags real buyers so you don't accidentally exclude them, and excludes a confirmed bot in one click.
• Page caching stays on. Works with LiteSpeed, WP Rocket, Varnish and Cloudflare full-page cache.
• Queue health is visible from your WordPress dashboard. A widget shows backlog size, the oldest pending event, and when the last dispatch succeeded, so a stuck queue doesn't go unnoticed.
• The bot blocklist maintains itself. Ranges for nine cloud providers ship with the plugin and refresh daily in the background. You can add your own, exclude any rule you disagree with, and download the active list as plain text.
• Test before you trust it. Send a test event to Meta or TikTok from the settings page and watch it arrive in Events Manager, with test-event codes handled for you.
• Privacy work is already done. The plugin registers with WordPress's personal-data export and erasure tools, contributes its own section to the privacy policy WordPress generates for you, and stores IP addresses only as salted hashes.

What this plugin stores To match server-side conversion events to the right person, the plugin stores SHA-256 hashes of contact details a visitor provides — email, phone, name and address components — against an opaque visitor identifier. Raw contact details are never written to disk; values are hashed before storage and the hash cannot be reversed.

• Two first-party cookies. An opaque visitor identifier (1 year) and a Meta-format browser identifier _fbp (90 days).
• 180-day retention. Records are deleted 180 days after they were last seen. Filterable via mcapi_identity_retention_days.
• Consent-gated. Nothing is stored, and nothing already stored is read, where marketing consent has been refused. Withdrawing consent expires both cookies and deletes the stored record.
• Privacy tools. WordPress's personal-data export and erasure both cover this data.
• Shared devices. A stored record is replaced whenever a new person identifies themselves and is deleted at logout. A second person who only browses without identifying themselves is covered by the 180-day expiry rather than by an immediate reset — worth knowing if your customers use shared or public computers.

Quick start (3 steps)

1. Install and activate the plugin. WooCommerce must already be active.
2. Open CAPI Suite → Main Settings and paste your Meta Pixel ID + Access Token. Add TikTok and/or Pinterest credentials if you use them. Empty fields for platforms you don't use are fine.
3. (If you use GTM) Download the bundled gtm-template.json from the GTM Container ID box, import it into your GTM container in Merge mode, set the pixel-code constants to your real IDs, and publish.

Server-side events start flowing on the next page view. Send a test from Event Management → Test Modes to verify credentials before going live. Recommended GTM dedup configuration To prevent duplicate browser+server events:

1. In Meta Events Manager → your Pixel → Settings → Event Setup, turn off "Track Events Automatically Without Code". This plugin handles all event sending.
2. In your GTM container, pause or delete any auto-created tags starting with FB_.

The bundled GTM template ships GA4 + Meta tags pre-wired to the GA4 ecommerce dataLayer, plus TikTok tags that read from a CONST - TikTok Pixel Code variable and Pinterest tags that read from CONST - Pinterest Tag ID. The Pinterest tags are new, and one of them ships paused. Earlier releases said Pinterest tags had to be built by hand because the Community Template could fail to import inside a container export. That is no longer true — it was re-tested against a real container, both as a Merge into an existing workspace and as a fresh import, and the Pinterest template and all eight tags came through intact — so they are bundled now. Seven of them are on by default: PageVisit, ViewContent, ViewCategory, AddToCart, InitiateCheckout, AddPaymentInfo and Search. Three of those (ViewContent, InitiateCheckout, AddPaymentInfo) are events the Conversions API has no name for at all, so the browser tag is the only way Pinterest ever hears about them. Pinterest - Checkout is paused on purpose, and only you can finish the check. Pinterest matches a tag event to a Conversions API event on event_id, and the tag passes it — but that pairing has not been confirmed on a live Pinterest account, and this plugin's author has no Pinterest ad account to confirm it on. Left paused, your Pinterest sales keep being reported from the server only, exactly as they are today, and cannot be counted twice. To finish the check: set CONST - Pinterest Tag ID, enable the tag, publish, make one real sale, and open Pinterest Events Manager. One checkout event means the pairing works and you can leave it on. Two means it does not — pause it again. One more thing if you report subscriptions separately: Pinterest's tag takes a fixed event name, so that tag sends checkout for a renewal too, while the server side deliberately reports renewals as custom. If you cannot import the JSON template (locked container, workspace permissions) or want to set up GTM manually, the full step-by-step walkthrough ships with the plugin at wp-content/plugins/easy-meta-capi/docs/GTM-MANUAL-SETUP.txt. Verify Open CAPI Suite → Event Log after browsing your store. Successful dispatches show as "Success (Meta)" / "Success (TikTok)" / "Success (Pinterest)". The Dashboard widget shows queue health at a glance. If the log stays empty, a JS optimizer is probably deferring the plugin's inline scripts — see the cache-plugin FAQ. Detailed GTM setup, Google Ads Enhanced Conversions, and other platform tags live in docs/GTM-MANUAL-SETUP.txt. Consent Mode v2, Strict server-side consent, CMP auto-block, and WC Subscriptions are documented under Advanced Configuration below. Advanced Configuration Setup details for Consent Mode v2, the strict server-side consent mode (GDPR PII gating), CMP auto-block compatibility, and the WooCommerce Subscriptions integration. None of these are required for a basic CAPI setup — turn them on as your store needs them. Consent Mode v2 Setup (GDPR / EU Compliance) If you serve EU visitors, Google's browser tags stop writing cookies when consent is denied — typically losing 20–50% of measured event volume. Google Consent Mode v2 recovers part of it: when consent is denied, those tags switch to cookieless pings (anonymous beacons carrying event name, value, currency and timestamp but no client identifier), and Google models the conversions from them and shows them mixed with observed ones in your reports. How to enable. Popular CMP plugins (Cookiebot, CookieYes, Complianz, Iubenda, Termly, OneTrust) all have a native Consent Mode v2 toggle in their settings — find and enable it. The CMP then calls gtag('consent', 'default', {denied}) before GTM loads and gtag('consent', 'update', {granted}) after the visitor accepts. If you use a consent banner, import the container again. The container shipping with this release stops the Meta, TikTok and Pinterest tags from firing for visitors who declined: all 23 of them now wait for ad_storage and ad_user_data before they run. Download it again and import it as described above, choosing Merge and then Overwrite conflicting tags, triggers, and variables — overwrite is what replaces the tags you already have. Tags you built yourself, under names the template does not use, are left alone. The same import returns the template's ID constants (CONST - Meta Pixel ID, CONST - GA4 Measurement ID, CONST - TikTok Pixel Code, CONST - Pinterest Tag ID, CONST - Google Ads Conversion ID, CONST - Google Ads Purchase Label) to their placeholder text, so enter your own values again before you publish. CONST - Google Ads Conversion ID now takes the number on its own — 1234567890, not AW-1234567890 — because the Google Tag in the template adds the AW- prefix itself. The bundled GTM template includes a paused "Consent Defaults (Pre-CMP)" tag. Enable it only if your CMP doesn't set gtag('consent', 'default', ...) on its own (rare with modern CMPs). Strict server-side consent mode (PII gating for CAPI) Consent Mode v2 only controls browser tags. Server-side CAPI fires from PHP, never sees gtag('consent', ...) signals — so it transmits hashed PII regardless of cookie-banner choice. Fine outside the EU; a GDPR concern inside it. The Privacy & Consent (Server-side) section has a Strict server-side consent toggle (default OFF). When enabled and the visitor has denied marketing consent in your CMP, identifying PII (em, ph, fn, ln, address, fbp, fbc …) is stripped from the CAPI payload. The event still ships with event_id, value, currency, contents — Cookiebot, CookieYes, and Complianz cookies are read automatically; other CMPs supply state via the mcapi_marketing_consent_granted filter. Whose answer is used. A Purchase usually fires later than the checkout it belongs to — when the order reaches a paid status, which for a redirect gateway can be hours or days, in a cron tick or a gateway webhook where the shopper's browser is nowhere in sight. The shopper's consent answer is therefore recorded onto the order at checkout (both the classic and the block checkout) and read back from there at send time. That is what makes the toggle honour the customer's own choice rather than whoever's browser happened to trigger the send — a shop manager working in wp-admin, for instance, whose own banner choice used to decide it. An order placed before this version, or created without a checkout, has no recorded answer and is treated as "no signal", the same as a visitor with no CMP cookie; a renewal inherits the answer given at the original purchase. Why this matters alongside Consent Mode v2. Denied-consent browser pixels switch to cookieless pings — modeled, not observed. With Strict server-side consent ON, your server-side CAPI ships alongside that ping carrying the same event_id. Meta dedupes by event_id and now has an observed server signal feeding the same conversion record the cookieless ping created — cleaner Event Match Quality than browser-only or naïve "send everything" CAPI, and GDPR-defensible because no identifying data leaves your server. Default OFF preserves match quality for existing non-EU setups. Recommended ON once Consent Mode v2 is configured in your CMP. CMP Auto-Blocking and the Plugin's Inline Scripts CMPs with "auto-blocking" (Cookiebot, CookieYes, others) scan every <script> tag on load and convert anything they suspect of tracking to type="text/plain" until consent. The plugin's inline scripts only POST first-party events to your own REST endpoint — but a generic auto-blocker can't tell. To avoid a silent break, every plugin-rendered inline script ships with opt-out attributes for Cookiebot (data-cookieconsent="ignore"), CookieYes (data-cookieyes="cookieyes-necessary"), and Complianz (data-cmplz-no-cookielaw="1"). For other CMPs (OneTrust, Quantcast, in-house), append your own attribute via the mcapi_inline_script_attrs filter. WooCommerce Subscriptions Integration By default, every WooCommerce Subscriptions auto-renewal sends a fresh Purchase to Meta CAPI — credited to the original acquisition ad. Reported ROAS keeps climbing month after month from the same conversion, polluting optimization signals. The plugin auto-detects WooCommerce Subscriptions and exposes: Subscription Renewal Behavior (radio):

• Default — renewals send as regular Purchase. Existing setups unchanged.
• Skip — renewals not sent. Cleanest ROAS hygiene; you forfeit Meta's LTV signal from renewals.
• Subscribe / SubscriptionRenewal events — Meta's standard Subscribe for sign-ups + a SubscriptionRenewal custom event for renewals. Purchase stays clean, advertisers using LTV-bidding can opt into both.

As of 3.11.0 there is no separate "Tag" mode: it was byte-identical to Default with the customer-status checkbox below also ticked, so it was retired in favor of that existing combination. A store already saved on Tag keeps behaving exactly as before — it's migrated automatically on upgrade. Tell Meta whether each buyer is new or returning (checkbox, works on any WooCommerce store — not only subscription sellers): adds custom_data.customer_status (new_customer / returning_customer, or subscription_renewal on stores with WooCommerce Subscriptions active) to every Purchase so Meta Advantage+ can bid acquisition vs. retention differently. Guest checkouts fall back to billing-email lookup. X-Forwarded-For Hop Count (advanced proxy setups) Behind a trusted reverse proxy, the real-IP resolver walks X-Forwarded-For from the right, skipping entries that look like trusted infrastructure (a known proxy CIDR or a private/reserved address), and uses the first one that doesn't. This defeats the common attack of forging a leftmost entry, but it has a residual gap: if your proxy is configured to pass X-Forwarded-For through unmodified instead of appending the hop it actually witnessed (nginx's proxy_set_header X-Forwarded-For $http_x_forwarded_for instead of $proxy_add_x_forwarded_for is the classic case), every entry in the header is client-controlled — a visitor can append a filler value that merely resembles infrastructure (e.g. a private-looking address) and have an earlier, forged entry accepted as their IP instead. The plugin cannot detect this misconfiguration or infer your real proxy hop count on its own. If you know it — one hop for a single reverse proxy, more for a CDN plus a local proxy — set it with the mcapi_trusted_proxy_hops filter: add_filter( 'mcapi_trusted_proxy_hops', function() { return 1; } ); This bounds how many trailing hops the walk will ever treat as trusted-and-skippable; once that many are skipped it stops rather than continuing further left, so a crafted filler hop beyond the boundary can no longer push an attacker-chosen address through. Default is unbounded (today's behaviour) — leave it unset unless you are certain of your topology, since too low a value can make the walk stop before reaching a real client hop.

3.10.0

• New: a Health tab that reports what this plugin is doing for your store and what to fix, in the order it matters. It checks your setup, your checkout fields, your background queue, and the revenue you reported against the orders your store actually took.
• Fix: the bundled GTM container no longer fires the Meta and TikTok pixels for visitors who declined consent. If you use a consent banner, import the container again — choose Merge, then Overwrite conflicting tags, triggers, and variables, and re-enter your Pixel and Tag IDs afterwards.
• New: choose what a Purchase reports as the sale amount — the order total, the total without shipping, or product revenue only. Existing stores keep reporting exactly what they did before.
• The settings screens no longer slow down as your store grows. Health figures are taken when you ask for them.

3.9.2

• Settings, Excluded Traffic and Event Log copy simplified. Product Identifier explanation moved behind "More detail"; the live sample stays visible.

3.9.1

• Fix: identity records survive a security-salt rotation — rotation is detected automatically, and orphaned rows are pruned safely in a resumable, cutoff-scoped sweep.
• Event Log By-IP columns are labeled clearly; the GTM manual is updated and linked; DSAR export field labels are human-readable.
• New: a one-time review request appears after the plugin's first successful Purchase.

3.9.0

• New: identity is remembered between visits — contact details a shopper gives anywhere on the site are stored as hashes and attached to later events instead of being discarded at checkout. The change that moves Event Match Quality.
• New: a visitor identifier and a Meta-format _fbp are issued by the server, surviving full-page caching and Safari's 7-day cookie cap. Hashed identity is published to window.dataLayer for Advanced Matching, consent-gated. Event Log shows match keys per event; WordPress's exporter/eraser handle this data.
• Fix: a merchant changing an order over admin-ajax or the REST API no longer has their own cookies attached to that customer's Purchase.
• Privacy: values are SHA-256 hashes, never raw contact details; records deleted 180 days after last seen.
• Behaviour change: minting a visitor identifier is now consent-gated — a guest on a CMP store with consent unanswered gets NO external_id. Expect PageView match quality to fall; that is the intended trade, not a bug.
• Behaviour change: a guest who volunteers no contact detail sees only one change — the added server-side _fbp cookie.

3.8.1

• Fix: a purchase paid after checkout could report the server's own IP address instead of the customer's.
• Fix: an order updated from wp-admin, cron, or WP-CLI could attach whoever's own browser cookies to that customer's purchase.
• Phone numbers without a country code now use the billing or store country. Facebook Login user IDs are now sent for stores offering that sign-in.
• Subscription renewals carry the subscription's own ID; a second email-derived identifier helps platforms recognise returning shoppers sooner.
• New mcapi_identity_extra_fields filter for gender/date of birth. Consent-denial stripping now covers these plus TikTok's click and pixel identifiers.

3.8.0

• Critical: GTM template re-import required — TikTok renamed event names, causing double-counted purchases until you re-import.
• Purchase now waits for a paid order status, firing later if needed. Fix: a stale queued event no longer discards a whole batch.
• Fix: Cloudflare bot score header reads correctly; a broken filter can't bypass bot filtering. Block checkout reports correct amounts in odd-decimal currencies and sends event_source_url. Event Log Refresh button works again.
• Fix: identity fields normalized to Meta's spec before hashing. An order paid after checkout keeps click identifiers, including ttclid; renewals inherit them too. Revisiting order-received could double-count a sale — fixed.
• Fix: X-Forwarded-For trusts the rightmost hop, not a forged leftmost one (new mcapi_trusted_proxy_hops filter). Contact Form 7's Lead event uses the shared hashing pipeline, avoiding a collision with a bad digest. event_id fallback now uses a UUID, and multibyte User-Agent values aren't truncated mid-character.
• Fix: rate limiting, uninstall cleanup, blocklist pagination, and exclusion-source labeling corrected. New: scheduler watchdog auto-reschedules a missing task. Graph API v26.0; TikTok events renamed Purchase/Lead.