Pixel Made Simple

Not exactly, and no plugin can promise that. Visitors who decline cookies aren't tracked, and each platform counts by its own rules. What changes: no event is sent twice, and with Pixel Made Simple Pro, sales that never reach the thank-you page aren't lost.

No plugin can make a site compliant on its own. What Pixel Made Simple does: Meta and TikTok load nothing before your visitor says yes in your cookie banner, and nothing after "Reject". Google loads in its "denied" mode until there is a yes (Consent Mode v2). Whether your whole setup is compliant also depends on your banner settings and your privacy policy.

That connection covers Meta. Pixel Made Simple sends to Meta, Google and TikTok with the same event ID, works with your cookie banner and shows you every event it sent.

Install Pixel Made Simple, enter your IDs and turn off the old plugin. If the same pixel still runs somewhere else – in another plugin or in your theme – the Platforms tab warns you. See "Does the plugin notice when a pixel runs twice?" below.

It adds 0 to 2 small files, around 6–9 KB, and no extra database queries on a normal page view. It works with speed plugins that delay JavaScript, too – see "Does the plugin work with page caching?" below.

Your settings can be exported from one site and imported on the next – then change the IDs. The duplicate pixel warning finds old tracking code left behind by a previous setup. And the free version shows no upgrade banners in your clients' dashboards.

Only what you allow, and only signed in as you. With WordPress 6.9 or newer, Pixel Made Simple registers its functions as WordPress Abilities. An MCP adapter plugin on your site, such as the official MCP Adapter, makes them available to AI tools like Claude. Your AI tool signs in with an application password and acts with your user rights – only administrators can use the abilities. An AI tool can read the tracking status, the event log, the consent statistics and your page events, check for duplicate pixels and test the connection (a request without an event). Access tokens are never part of an answer – it only learns whether one is saved. Creating and changing page events (and, in Pixel Made Simple Pro, click events) and switching them on or off works only after you turn on Allow AI to create and change events in the AI assistants tab. An AI tool can never delete anything or change your settings. The plugin itself sends nothing to an AI provider. Your AI tool fetches the data from your site; what happens to it there depends on the tool and its provider.

Only the ones you configure yourself. With no platform set up it writes no third-party script, image or request into your pages at all. Every address it can contact, what is transmitted and when, is listed under External services below.

Enter the test event code from the Events Manager (tab Test events) in the Meta card of the Platforms tab. Server events then show up there in real time. The code is removed automatically after 12 hours. For debugging you can make the request blocking, after which the raw Meta response is written to the debug log when WP_DEBUG_LOG is enabled: add_filter( 'pxms_capi_blocking', '__return_true' );

That is your decision, and the plugin lets you make it per provider. By default every privacy tracker runs through the same marketing consent gate as the Meta and TikTok pixels – nothing loads until the visitor accepts, and it then starts without a page reload. The Load without cookie consent switch changes that for one provider only; it does not change how any advertising platform loads. Google Ads and GA4 follow the Consent Mode v2 setting: with it they load right away, with every consent signal set to “denied”. The background: Section 25 TDDDG covers storing information on, or reading it from, a visitor’s device. A tracker that sets no cookie and uses no local storage is not covered by it; the GDPR level applies regardless. Whether that reasoning holds depends on the specific service and where it is hosted, and it is legally contested. Pixel Made Simple makes no claim about any third-party service being compliant – it only provides the setting.

The one from your own dashboard, copied verbatim – for example https://plausible.io/js/pa-XXXXXXXX.js, https://cloud.umami.is/script.js or https://app.rybbit.io/api/script.js. Self-hosted instances use your own domain instead. For Plausible, both snippets work: with the newer pa-….js script the plugin adds Plausible's plausible.init() itself and the domain field stays empty; the older script.js needs the domain. The plugin deliberately does not assemble that address from a host name. All three providers have changed their paths at least once (Umami moved from /umami.js to /script.js, Plausible issues newer accounts a per-site tracker filename, Rybbit switched from an attribute to a query parameter). A path guessed by the plugin would eventually be silently wrong: the script loads and no data arrives.

No, and that is intentional. They are not conversions, they never go through the Conversions API, and counting them would dilute exactly the numbers you use to investigate missing advertising conversions. The event log and the consent statistics keep reporting on Meta, Google and TikTok only.

The automatic cookie banner detection (on by default) checks the consent cookies of the supported banner plugins and the WP Consent API on the server. Without marketing consent the browser scripts are deferred (they listen for the banner’s consent events and start right after the click on “Accept”) and, with the default setting “Server-side events: Wait for consent”, the Conversions API request is not sent. Google Ads and GA4 are the exception while Google Consent Mode v2 is on: gtag.js then loads right away with every consent signal set to “denied”. Once the visitor grants marketing consent, the plugin lifts Google’s three advertising signals (ad_storage, ad_user_data, ad_personalization) itself, so Google Ads can count the conversion. analytics_storage for GA4 stays your banner’s decision – turn on Google Consent Mode in your banner, otherwise GA4 only measures without cookies; the Cookie Banner tab tells you when it is off. Must-Have Cookie blocks gtag.js until the next page view after “Accept”; if Google Ads should not miss a conversion on that first page, exclude gtag.js from its blocking. If no supported banner is detected, the Cookie Banner tab asks what to do – track everyone (your site has no banner), block until consent, or check a consent cookie you describe yourself. Until you answer, every visitor is tracked. For unsupported banners you can provide the consent result yourself: add_filter( 'pxms_has_marketing_consent', function ( $consent ) { return my_marketing_consent(); } ); And you can suppress all tracking server-side: add_filter( 'pxms_allow_tracking', function ( $allow ) { return my_consent_check(); } );

The browser pixel: yes. The Conversions API is normally only triggered when PHP actually renders the page, so with aggressive full-page caching you should exclude your conversion pages from the cache – otherwise CAPI events are not sent at all, and every visitor shares the one event ID baked into the cached HTML. One exception, since 0.11.0: a URL event that participates in the handover to the confirmation page is sent from the browser and generates its event ID per visitor. That one works on a cached page. All other URL events still need the page to be excluded from the cache. Form leads are sent from the browser as well, so they work on cached pages. Since 0.17.1 that also holds when a page has been cached for days: WordPress’s security check (the nonce) in a cached page expires after 12 to 24 hours, and the plugin then fetches a fresh one before it sends – for form leads and for the handover event on the confirmation page. Pages that were rendered recently send no extra request. In Pixel Made Simple Pro, click events and shop events do without a nonce altogether. Speed plugins that delay JavaScript until the first interaction (LiteSpeed Cache, WP Rocket, xSpeed and others) leave the scripts that record form leads, clicks and shop events alone since 0.19.0 – otherwise a tap on your phone number as the first interaction would get lost. The pixels of Meta, Google and TikTok stay delayable. Consent is not cached along with the page. When a cookie banner is detected, the page contains no decision – the visitor’s browser checks the consent cookie on every page view, so a cached page never hands one visitor’s consent to the next.

Yes, in two ways. The Platforms tab recognises the common tracking plugins (PixelYourSite, Meta for WooCommerce, Meta pixel for WordPress, Site Kit by Google, MonsterInsights, ExactMetrics, Google Analytics for WooCommerce, Google for WooCommerce, Pixel Manager for WooCommerce, TikTok for WooCommerce) and warns you when one of them sends to the same ID. And Check for duplicate pixels at the end of that tab loads a page of your site and looks for tracking code that does not come from Pixel Made Simple. Limits of the page check: the contents of a Google Tag Manager container cannot be seen, only the container itself. A pixel that a cookie banner only adds after consent is not in the page yet – unless the banner keeps it as blocked code in the HTML. One check covers one page; for a pixel that only runs on your thank-you page, enter that address. If your host blocks requests from the site to itself (password protection, a firewall, maintenance mode), the check says so instead of guessing.

Click Test connection at the top of the Meta card in the Platforms tab – the button appears once a token is entered. The plugin sends one request with your saved token that Meta rejects on purpose after checking the token – it contains no event, so nothing is recorded. The answer says in plain words whether the token works for your pixel, belongs to a different pixel, or is invalid or revoked. The same test exists for the TikTok Events API token in Pixel Made Simple Pro. Why a test at all: server-side events are sent without waiting for the answer, so pages stay fast. The log therefore lists them as “Sent” – whether the platform accepted them, only the test (or the live debug bar) can tell.

It counts the intent, not the call. Pixel Made Simple Pro can count a click on a phone number, an email address or a WhatsApp button as a conversion (Click Events in the Events tab). Whether the call really happens, no website can know – on a computer, a phone link often opens nothing at all. Each rule counts at most once per visit, so repeated taps do not inflate your numbers. WhatsApp chat plugins such as Joinchat and Click to Chat can report clicks to Meta and Google themselves. If that is switched on there as well, the same click counts twice – use one of the two.

No. sessionStorage belongs to exactly one origin, so nothing travels to another domain or subdomain – the same applies to a form inside an iframe from a different origin. In those cases both events are counted separately, exactly as before version 0.11.0. If the confirmation page is on a subdomain, moving it to a path on the main domain (/thank-you/ instead of thanks.example.com) is enough to get the full match.

The rule compares the address as visitors see it, language prefix included. With Polylang or WPML and English under /en/, an “exact path” rule for /thanks/ does not match /en/thanks/. Add one rule per language, or use “URL contains” with /thanks/ if the slug is the same in every language.

Three things have to line up. In your Google Ads account, Enhanced Conversions must be enabled for that conversion action and the customer data terms accepted – without that Google discards the data silently and still counts the conversion. In the plugin, the event needs a conversion label. And for the phone number Google requires the international format: if your form collects 0151 … without a country code, only the email address is sent. The filter pxms_normalize_phone can add the country code.

• pxms_allow_tracking – allow or suppress tracking globally.
• pxms_has_marketing_consent – override the result of the cookie banner detection (guards the browser pixel).
• pxms_has_server_consent – the same for server-side signals (Conversions API, TikTok Events API). Only relevant when “Server-side events” is set to “Always send”.
• pxms_consent_banner_active – register your own banner with the detection.
• pxms_consent_events – additional banner events for the frontend listener.
• pxms_capi_event_data – modify a single CAPI event before it is sent (e.g. add custom_data).
• pxms_capi_user_data – modify the user_data payload.
• pxms_normalize_phone – adjust the normalised phone number before hashing (e.g. add a country code). Also decides whether Google gets a phone number at all: without a country code there is no valid E.164 value, and none is sent.
• pxms_graph_api_version – override the Graph API version.
• pxms_capi_blocking – send the CAPI request blocking (debugging).
• pxms_tiktok_capi_blocking – the same for TikTok Events API requests (Pixel Made Simple Pro, debugging).
• pxms_client_ip – the visitor’s IP address for the Conversions API and the TikTok Events API, for a proxy the plugin does not know (Cloudflare is recognised automatically). Only take a header such as X-Forwarded-For if your own proxy sets it – otherwise every visitor can choose its value.

Source strings are English. The free version gets its translations from translate.wordpress.org, and WordPress installs them automatically – its /languages folder only holds the POT template. Pixel Made Simple Pro additionally ships the finished German translation (-de_DE.po/.mo). Custom translations made with Loco Translate are best stored under “System” (wp-content/languages/loco/plugins/) so they survive updates.

• Personal data is only ever sent to the platforms above, never stored by the plugin. Email addresses and phone numbers from form submissions are hashed (SHA-256) in memory and discarded.
• The event log stores event names, event IDs, status codes and the names of the match keys used (e.g. em, fbc) – never the values.
• The consent statistics store aggregated daily counters only: one row per calendar day with three integers (sent, blocked by consent, not configured). There is no IP address, no user agent, no event ID and no timestamp below day level – the plugin does not and cannot track who declined consent. Rows older than 30 days are deleted automatically.
• The handover to the confirmation page uses the browser’s sessionStorage and holds an event ID plus SHA-256 hashes – four of them since 0.11.1 (Meta and Google normalise differently), never a plain-text email address or phone number. The entry is never sent to the server, does not survive closing the tab, expires after 10 minutes and can be used exactly once. In the default consent mode it is not created at all without marketing consent.
• The first-touch attribution cookie pxms_attribution (Pro, off by default) stores UTM parameters and click IDs for 30 days in a first-party cookie.
• To limit abuse, the requests that send form leads – and in Pixel Made Simple Pro click and shop events – are counted per visitor for one minute (with IPv6 per /64 network). The counter sits in a small table of the plugin under a salted hash of the address, never the address itself, and the daily cleanup removes it. What remains is the number of requests turned away per day, kept for 30 days.
• Please check with your data protection officer whether “Server-side events: Always send” is permissible for your site; the default (“Wait for consent”) holds back server-side events as well.
• WooCommerce purchases (Pro): when an order is placed, the plugin stores the customer’s consent decision with the order and – only if they consented – their _fbp/_fbc values. The server-side fallback uses them, together with the IP address and user agent WooCommerce stores anyway, when a purchase is reported later (for example after a bank transfer arrives). This way an administrator who updates the order never sends their own data or consent in place of the customer’s. The values stay with the order like WooCommerce’s own customer data.

Yes, as soon as neither variant (free or Pro) is installed anymore. uninstall.php then deletes all plugin options including the stored access token, the event log table and the scheduled cleanup task. Switching from free to Pro (or back) keeps your configuration – both use the same option keys.