Easy Meta CAPI & GTM -- WordPress 插件

CAPI Suite: Meta Pixel, Pinterest & TikTok for WooCommerce

开发者	suhanduman cenkcagdas
更新时间	2026年8月24日 04:31

开发者

suhanduman
cenkcagdas

更新时间

2026年8月24日 04:31

详情介绍:

Meta Pixel, Pinterest and TikTok, sent server-side, in one free plugin. Two of the largest plugins in this category keep server-side sending for their paid tier, and the biggest sells Pinterest separately — here all three platforms are in the free core, plus a bundled Google Tag Manager template for browser-side tracking. Every checkout and cart event, classic and block-based checkout, HPOS compatible, each platform retried independently on failure. No cloud server to rent, no premium tier to unlock, no event limit. Renewals don't inflate your ROAS. Subscription renewals are detected and can be skipped or sent as their own event, so the original campaign is not credited with revenue it did not earn. Bots don't get counted as customers. Datacenter ranges plus real-browser behaviour are weighed together, and purchases are never held back while that judgment happens. Filtering at this level normally means paying monthly for a server-side setup. Safari visitors stay attributable for 90 days, not 7. The cookie is written by the server, so Safari's seven-day cap on script-written cookies stops resetting the visitor every week. Your orders are counted once, not twice. The same event ID goes out browser-side and server-side, so each platform matches them up instead of double-counting. You keep your analytics when a visitor declines cookies. The event still goes through for counting, with personal details stripped out first.

A bundled GTM template gets your browser-side tags running in minutes. GA4, Meta Pixel, Pinterest Tag, TikTok Pixel and Google Ads tags come pre-wired, with Enhanced Conversions and Conversion Linker already attached — normally an afternoon of manual GTM work.
You can see exactly what was sent, and undo a bad exclude. The Event Log's By-IP view groups repeat traffic together, flags real buyers so you don't accidentally exclude them, and excludes a confirmed bot in one click.
Page caching stays on. Works with LiteSpeed, WP Rocket, Varnish and Cloudflare full-page cache — click IDs are captured into a cookie client-side, so a cached landing page never loses attribution.
Queue health is visible from your WordPress dashboard. A widget shows backlog size, the oldest pending event, and when the last dispatch succeeded, so a stuck queue doesn't go unnoticed.

What this plugin stores To match server-side conversion events to the right person, the plugin stores SHA-256 hashes of contact details a visitor provides — email, phone, name and address components — against an opaque visitor identifier. Raw contact details are never written to disk; values are hashed before storage and the hash cannot be reversed.

Two first-party cookies. An opaque visitor identifier (1 year) and a Meta-format browser identifier _fbp (90 days).
180-day retention. Records are deleted 180 days after they were last seen. Filterable via mcapi_identity_retention_days.
Consent-gated. Nothing is stored, and nothing already stored is read, where marketing consent has been refused. Withdrawing consent expires both cookies and deletes the stored record.
Privacy tools. WordPress's personal-data export and erasure both cover this data.
Shared devices. A stored record is replaced whenever a new person identifies themselves and is deleted at logout. A second person who only browses without identifying themselves is covered by the 180-day expiry rather than by an immediate reset — worth knowing if your customers use shared or public computers.

安装:

Quick start (3 steps)

Install and activate the plugin. WooCommerce must already be active.
Open CAPI Suite → Main Settings and paste your Meta Pixel ID + Access Token. Add TikTok and/or Pinterest credentials if you use them. Empty fields for platforms you don't use are fine.
(If you use GTM) Download the bundled gtm-template.json from the GTM Container ID box, import it into your GTM container in Merge mode, set the pixel-code constants to your real IDs, and publish.

Server-side events start flowing on the next page view. Send a test from Event Management → Test Modes to verify credentials before going live. Recommended GTM dedup configuration To prevent duplicate browser+server events:

In Meta Events Manager → your Pixel → Settings → Event Setup, turn off "Track Events Automatically Without Code". This plugin handles all event sending.
In your GTM container, pause or delete any auto-created tags starting with FB_.

The bundled GTM template ships GA4 + Meta tags pre-wired to the GA4 ecommerce dataLayer, plus TikTok tags that read from a CONST - TikTok Pixel Code variable. Pinterest tags are added manually because the Community Template can fail to import inside container exports. If you cannot import the JSON template (locked container, workspace permissions) or want to set up GTM manually, the full step-by-step walkthrough ships with the plugin at wp-content/plugins/easy-meta-capi/docs/GTM-MANUAL-SETUP.txt. Verify Open CAPI Suite → Event Log after browsing your store. Successful dispatches show as "Success (Meta)" / "Success (TikTok)" / "Success (Pinterest)". The Dashboard widget shows queue health at a glance. If the log stays empty, a JS optimizer is probably deferring the plugin's inline scripts — see the cache-plugin FAQ. Detailed GTM setup, Google Ads Enhanced Conversions, and other platform tags live in docs/GTM-MANUAL-SETUP.txt. Consent Mode v2, Strict server-side consent, CMP auto-block, and WC Subscriptions are documented under Advanced Configuration below.

升级注意事项:

3.9.2 Plainer wording on the settings screens. From 3.8.x you also get 3.9.0-3.9.1: hashed contact details kept up to 180 days, two first-party cookies, and a new privacy-policy section to review. An unanswered consent banner now counts as no consent, so match quality may read lower than before. 3.9.1 Fixes identity records being orphaned by a security-salt rotation (WordPress secret keys changed), pruning them safely now. By-IP column labels, GTM manual, and DSAR export labels are clearer. A one-time review request appears after your first successful Purchase. No action needed. 3.9.0 This release stores hashed contact details for up to 180 days to improve ad match quality, and sets two first-party cookies. Nothing is stored where marketing consent is refused — and minting a visitor identifier is now consent-gated too, so on a CMP-equipped store with consent unanswered, guests get NO external_id where 3.8.1 minted one unconditionally; you may see PageView match quality fall after updating. Review your privacy policy — the plugin now contributes its own section to the one WordPress generates. 3.8.1 Fixes an order paid after checkout reporting your server's own IP address as the customer's, which cost match quality on every purchase through a redirect payment gateway, and a related issue where updating an order's status yourself in wp-admin could attach your own browsing identity to that customer's purchase. Also sends more identifying detail with each event, all of it respecting existing consent settings. No action needed. 3.8.0 Critical: GTM template re-import required — TikTok double-counting otherwise. TikTok renamed its event names in 2025 (CompletePayment → Purchase, SubmitForm → Lead); the server-side CAPI call sends the new name, but the bundled GTM template's TikTok Purchase tag still sent the retired CompletePayment name until this release. TikTok deduplicates browser and server events by event name plus event_id — with the two sides disagreeing, dedup never matched and every TikTok purchase reported twice. Re-download gtm-template.json from Main Settings and re-import your GTM container in Merge mode (or edit the "TikTok - Purchase" tag's Event Name to Purchase manually — see docs/GTM-MANUAL-SETUP.txt). Behaviour change: Purchase now waits for a paid order status. Previously a Purchase was sent as soon as the order-received page loaded, even when payment had failed — so an abandoned payment at a redirect gateway still counted as a sale in Meta. It is now sent when the order reaches a paid status (by default whatever WooCommerce treats as paid, plus On hold), and if that happens later the event is sent then, even if the customer never returns. Stores with a custom order status should check Event Management → Send Purchase when the order is after updating; a one-time notice points you there. Also fixes a bug where one stale queued event could silently discard a whole batch of valid ones. Also corrects identity-field normalization, so hashed customer data actually matches, and keeps ad-click IDs attached to orders that are paid after checkout. 3.7.2 Hotfix for a 3.7.1 dispatch-halt regression. Sites where Action Scheduler marked mcapi_process_event_queue as "failed after 300 seconds" auto-recover on update. Plus three additional bot/human detection signals: Cloudflare Bot Management score header (if you forward it to your origin), navigator.webdriver browser-automation flag, and ip_state.human_score >= 100 strong-trust now qualifies as a Customer signal on its own. 3.7.1 Browser-side AddToCart dataLayer push restored on themes that don't render a WC cart widget (was silently lost — server-side CAPI was always firing). Behavioral bot filter no longer leaks 3-5 event burst patterns into trusted state. Two small admin hygiene fixes. 3.7.0 Event Log gains a By-IP grouped view and customer-protection badges that prevent excluding real buyers by mistake. AI crawlers (GPTBot, PerplexityBot, ClaudeBot, etc.) classified separately from bots with their own counter on the Dashboard. Block-list terminology clarified to Exclude (it filters CAPI dispatch, not site access). Google Ads Enhanced Conversions and Pinterest _epik capture continue from earlier work — re-import the GTM template if you haven't yet. One additive DB column on upgrade (instant DDL on InnoDB 5.7+ / MariaDB 10.3+). 3.6.0 TikTok CAPI added. Plugin renamed to CAPI Suite. Behavioral bot detection (VPN shoppers no longer misclassified). Blocklist DB tables (IPv4+IPv6) with per-source toggle and one-click CIDR block on Event Log rows. CCPA toggle. Re-import the GTM template for TikTok tags. 3.5.3 Reliability fixes. (1) Spurious AJAX add_to_cart events from sessionStorage fragment replay eliminated. (2) Per-platform queue retry: only the failing side is retried. (3) Event Log captures User Agent, supports date-range filtering, retention configurable. No GTM template change. 3.5.2 Critical: GTM template re-import required. Bundled template migrated to modern GTM API schema. Older templates rejected with "File format invalid"/"Unknown entity type". Re-download and re-import in Merge mode. Plugin runtime unchanged. 3.5.1 Critical hotfix. v3.5.0's CMP detection helper called class_exists() without disabling autoload, triggering CookieYes / Cookie Law Info fatal errors (white screen). Update immediately if you have either plugin installed. 3.5.0 GTM template re-import required. Fixes import-error bug ("Unrecognized value [customEvent]"). Adds Consent Mode v2, CMP auto-block exemptions (CookieYes/Cookiebot/Complianz), and WooCommerce Subscriptions integration. Server-side CAPI unchanged. 3.4.2 Action required for existing installs. Fixes a GA4-schema bug causing Meta Events Manager to reject browser-tag parameters. Re-import the GTM template ("Merge" mode) OR add two new Custom JavaScript variables manually.

常见问题:

Does this plugin replace the Meta Pixel?

No, it works alongside it. The plugin sends server-side (CAPI) events, while GTM handles the browser-side Pixel. Both use the same event_id, so Meta merges them automatically without counting anything twice.

What is the difference between this and a GTM Server Container?

A GTM Server Container runs on Google Cloud and costs money every month. This plugin does the same job directly from your WordPress server — no extra infrastructure, no extra bill.

Does it work with page caching plugins (WP Rocket, LiteSpeed, etc.)?

Yes. PageView and ViewCategory events fire from JavaScript, so they work even on fully cached pages. Cart, checkout, and purchase pages are not cached by default.

What plugins are required?

WooCommerce. That's it. If you use other GTM plugins (like Google Site Kit), disable their e-commerce features to avoid conflicts.

Is there a pro version?

No. Everything is included.

My events aren't showing in Meta Events Manager.

Open the Event Log tab. If events appear there with "Success (Meta)", the plugin is sending — anything missing on Meta's end is a Pixel ID / Access Token mismatch. If the log is empty, your JS optimizer is likely deferring the inline scripts (see next answer) or your CMP auto-blocker converted them to type="text/plain" (see the CMP question below).

JS optimizer (LiteSpeed / WP Rocket / Autoptimize) — what do I configure?

Add these four IDs to your optimizer's "exclude from defer / combine" list: mcapi-pageview-init, mcapi-viewcontent-events, mcapi-viewcategory-events, mcapi-frontend-events. Cloudflare Rocket Loader is handled automatically via data-cfasync="false".

Does it work with a block-based theme (Twenty Twenty-Five etc.)?

Yes.

GTM Preview shows my browser tags firing, but the plugin's Event Log is empty.

Your CMP's auto-blocker is converting the plugin's inline scripts to type="text/plain". The plugin already carries opt-out attributes for Cookiebot, CookieYes, and Complianz; less common CMPs (OneTrust etc.) need the mcapi_inline_script_attrs filter — see CMP Auto-Blocking in Advanced Configuration.

I sell subscriptions — Meta is over-attributing renewals to old ads.

The plugin auto-detects WooCommerce Subscriptions and offers four behavior modes (Default / Skip / Tag / Subscribe + SubscriptionRenewal). Pick Skip or the dedicated-events mode to keep Purchase clean. See WooCommerce Subscriptions in Advanced Configuration.

EU traffic — does the plugin respect cookie-banner consent for CAPI?

Not by default — server-side CAPI fires from PHP, doesn't see your gtag('consent', ...) signals. The Privacy & Consent section has a Strict server-side consent mode toggle: when consent is denied, hashed PII is stripped from the CAPI payload but the event still ships with its event_id, so Meta's browser↔CAPI dedup keeps working without identifying data. Recommended ON for EU stores. See Strict server-side consent mode in Advanced Configuration.

Will the datacenter IP filter block my real VPN customers?

Rarely. Visitors with click IDs (fbclid / gclid / ttclid), Apple Private Relay IPs, logged-in customers, or prior-visit _fbp / _ga cookies all bypass the filter. Purchase events are never blocked. A brand-new VPN visitor with no cookies has their first PageView held; if they purchase, the full funnel is replayed so Meta sees the complete journey. Every blocked request is auditable in the Excluded Traffic tab.

Why does the Excluded Traffic tab show IPs as 192.168.1.x?

GDPR-friendly auditing — the last octet is masked at record-time, so wp-admin and DB exports never reveal raw visitor IPs.

更新日志:

3.9.2

Settings, Excluded Traffic and Event Log copy simplified. Product Identifier explanation moved behind "More detail"; the live sample stays visible.

3.9.1

Fix: identity records survive a security-salt rotation — rotation is detected automatically, and orphaned rows are pruned safely in a resumable, cutoff-scoped sweep.
Event Log By-IP columns are labeled clearly; the GTM manual is updated and linked; DSAR export field labels are human-readable.
New: a one-time review request appears after the plugin's first successful Purchase.

3.9.0

New: identity is remembered between visits — contact details a shopper gives anywhere on the site are stored as hashes and attached to later events instead of being discarded at checkout. The change that moves Event Match Quality.
New: a visitor identifier and a Meta-format _fbp are issued by the server, surviving full-page caching and Safari's 7-day cookie cap. Hashed identity is published to window.dataLayer for Advanced Matching, consent-gated. Event Log shows match keys per event; WordPress's exporter/eraser handle this data.
Fix: a merchant changing an order over admin-ajax or the REST API no longer has their own cookies attached to that customer's Purchase.
Privacy: values are SHA-256 hashes, never raw contact details; records deleted 180 days after last seen.
Behaviour change: minting a visitor identifier is now consent-gated — a guest on a CMP store with consent unanswered gets NO external_id. Expect PageView match quality to fall; that is the intended trade, not a bug.
Behaviour change: a guest who volunteers no contact detail sees only one change — the added server-side _fbp cookie.

3.8.1

Fix: a purchase paid after checkout could report the server's own IP address instead of the customer's.
Fix: an order updated from wp-admin, cron, or WP-CLI could attach whoever's own browser cookies to that customer's purchase.
Phone numbers without a country code now use the billing or store country. Facebook Login user IDs are now sent for stores offering that sign-in.
Subscription renewals carry the subscription's own ID; a second email-derived identifier helps platforms recognise returning shoppers sooner.
New mcapi_identity_extra_fields filter for gender/date of birth. Consent-denial stripping now covers these plus TikTok's click and pixel identifiers.

3.8.0

Critical: GTM template re-import required — TikTok renamed event names, causing double-counted purchases until you re-import.
Purchase now waits for a paid order status, firing later if needed. Fix: a stale queued event no longer discards a whole batch.
Fix: Cloudflare bot score header reads correctly; a broken filter can't bypass bot filtering. Block checkout reports correct amounts in odd-decimal currencies and sends event_source_url. Event Log Refresh button works again.
Fix: identity fields normalized to Meta's spec before hashing. An order paid after checkout keeps click identifiers, including ttclid; renewals inherit them too. Revisiting order-received could double-count a sale — fixed.
Fix: X-Forwarded-For trusts the rightmost hop, not a forged leftmost one (new mcapi_trusted_proxy_hops filter). Contact Form 7's Lead event uses the shared hashing pipeline, avoiding a collision with a bad digest. event_id fallback now uses a UUID, and multibyte User-Agent values aren't truncated mid-character.
Fix: rate limiting, uninstall cleanup, blocklist pagination, and exclusion-source labeling corrected. New: scheduler watchdog auto-reschedules a missing task. Graph API v26.0; TikTok events renamed Purchase/Lead.

3.7.2

Hotfix: a 3.7.1 regression could halt the event queue after a burst of events; auto-recovers on update.
New: Cloudflare Bot Management score, navigator.webdriver, and human-score signals added to bot detection. Cloudflare does not send this score automatically — add it via a Transform Rule.

3.7.1

Fix: AddToCart tracking restored on themes without a cart widget. Bot filter no longer lets small event bursts slip into trusted state.

3.7.0

New: Event Log By-IP view, customer-protection badges, AI-crawler classification. "Block" renamed "Exclude". Google Ads Enhanced Conversions and Pinterest _epik capture — re-import GTM template.

3.6.0

New: TikTok CAPI; plugin renamed to CAPI Suite. Behavioral bot detection, redesigned IP blocklist, CCPA toggle, dashboard widget. Re-import the GTM template. For older versions (3.5.3 and below), see the SVN repository history at https://plugins.svn.wordpress.org/easy-meta-capi/tags/.

CAPI Suite: Meta Pixel, Pinterest & TikTok for WooCommerce

标签

下载

详情介绍:

安装:

升级注意事项:

常见问题:

更新日志: