| 开发者 | seitzdominik |
|---|---|
| 更新时间 | 2026年9月19日 16:14 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
fbq() (eventID) and the Conversions API (event_id), so Meta deduplicates the pair automatically.wp_remote_post() – no impact on page load time. user_data contains client IP, user agent, the _fbp/_fbc cookies (with a fallback from fbclid) and – optionally – the SHA-256 hashed email address of logged-in users.ad_storage, ad_user_data, ad_personalization and analytics_storage start out as “denied” and your banner sends the update. Form leads additionally carry Enhanced Conversions data, hashed to Google’s own rules (they differ from Meta’s, so both values are carried separately).gtag.js loader – enter the Measurement ID and page views and events are picked up. Independent of Google Ads above.Lead on /thank-you/. Ideal for thank-you and confirmation pages.sessionStorage. A matching URL rule there reports the same event instead of a second one: if the submission got through, Meta deduplicates the pair; if it was lost during the redirect, the confirmation page is its full replacement. Either way one conversion – with email and phone in the match. With Google Ads configured, the same conversion also carries Enhanced Conversions data (gtag('set','user_data', …)), hashed to Google’s own rules – they differ from Meta’s, so both values are carried separately.Lead or Contact in the browser and via CAPI with the same event ID. Email and phone number are hashed with SHA-256 before they leave your server; raw values are never stored or logged. Optional URL filter and automatic exclusion of search, comment and login forms. Submissions that redirect to a confirmation page hand their data over to it (see above).Only the ones you configure yourself. With no platform set up it writes no third-party script, image or request into your pages at all. Every address it can contact, what is transmitted and when, is listed under External services below.
Enter the test event code from the Events Manager (tab Test events) in the General tab. Server events then show up there in real time. The code is removed automatically after 12 hours. For debugging you can make the request blocking, after which the raw Meta response is written to the debug log when WP_DEBUG_LOG is enabled:
add_filter( 'pxms_capi_blocking', '__return_true' );
That is your decision, and the plugin lets you make it per provider. By default every privacy tracker runs through exactly the same marketing consent gate as the Meta, Google and TikTok pixels – nothing loads until the visitor accepts, and it then starts without a page reload. The Load without consent switch changes that for one provider only; the advertising platforms are never affected by it. The background: Section 25 TDDDG covers storing information on, or reading it from, a visitor’s device. A tracker that sets no cookie and uses no local storage is not covered by it; the GDPR level applies regardless. Whether that reasoning holds depends on the specific service and where it is hosted, and it is legally contested. Pixel Made Simple makes no claim about any third-party service being compliant – it only provides the setting.
The one from your own dashboard, copied verbatim – for example https://plausible.io/js/script.js, https://cloud.umami.is/script.js or https://app.rybbit.io/api/script.js. Self-hosted instances use your own domain instead.
The plugin deliberately does not assemble that address from a host name. All three providers have changed their paths at least once (Umami moved from /umami.js to /script.js, Plausible issues newer accounts a per-site tracker filename, Rybbit switched from an attribute to a query parameter). A path guessed by the plugin would eventually be silently wrong: the script loads and no data arrives.
No, and that is intentional. They are not conversions, they never go through the Conversions API, and counting them would dilute exactly the numbers you use to investigate missing advertising conversions. The event log and the consent statistics keep reporting on Meta, Google and TikTok only.
The automatic cookie banner detection (on by default) checks the consent cookies of the supported banner plugins and the WP Consent API on the server. Without marketing consent the browser scripts are deferred (they listen for the banner’s consent events and start right after the click on “Accept”) and the Conversions API request is not sent. If no supported banner is installed, nothing is blocked.
For unsupported banners you can provide the consent result yourself:
add_filter( 'pxms_has_marketing_consent', function ( $consent ) { return my_marketing_consent(); } );
And you can suppress all tracking server-side:
add_filter( 'pxms_allow_tracking', function ( $allow ) { return my_consent_check(); } );
The browser pixel: yes. The Conversions API is normally only triggered when PHP actually renders the page, so with aggressive full-page caching you should exclude your conversion pages from the cache – otherwise CAPI events are not sent at all, and every visitor shares the one event ID baked into the cached HTML. One exception, since 0.11.0: a URL event that participates in the handover to the confirmation page is sent from the browser and generates its event ID per visitor. That one works on a cached page. All other URL events still need the page to be excluded from the cache.
No. sessionStorage belongs to exactly one origin, so nothing travels to another domain or subdomain – the same applies to a form inside an iframe from a different origin. In those cases both events are counted separately, exactly as before version 0.11.0. If the confirmation page is on a subdomain, moving it to a path on the main domain (/thank-you/ instead of thanks.example.com) is enough to get the full match.
Three things have to line up. In your Google Ads account, Enhanced Conversions must be enabled for that conversion action and the customer data terms accepted – without that Google discards the data silently and still counts the conversion. In the plugin, the event needs a conversion label. And for the phone number Google requires the international format: if your form collects 0151 … without a country code, only the email address is sent. The filter pxms_normalize_phone can add the country code.
pxms_allow_tracking – allow or suppress tracking globally.pxms_has_marketing_consent – override the result of the cookie banner detection (guards the browser pixel).pxms_has_server_consent – the same for server-side signals (Conversions API, TikTok Events API). Only relevant when the consent mode is set to “Block browser pixels only”.pxms_consent_banner_active – register your own banner with the detection.pxms_consent_events – additional banner events for the frontend listener.pxms_capi_event_data – modify a single CAPI event before it is sent (e.g. add custom_data).pxms_capi_user_data – modify the user_data payload.pxms_normalize_phone – adjust the normalised phone number before hashing (e.g. add a country code). Also decides whether Google gets a phone number at all: without a country code there is no valid E.164 value, and none is sent.pxms_graph_api_version – override the Graph API version.pxms_capi_blocking – send the CAPI request blocking (debugging).pxms_tiktok_capi_blocking – the same for TikTok Events API requests (Pixel Made Simple Pro, debugging).lmpct_*. Custom code that hooks into one of them must be updated to the pxms_* names – see the 0.6.0 changelog entry.
Source strings are English. The /languages folder contains the POT template and the finished German translation (-de_DE.po/.mo). Custom translations made with Loco Translate are best stored under “System” (wp-content/languages/loco/plugins/) so they survive updates.
Yes, as soon as neither variant (free or Pro) is installed anymore. uninstall.php then deletes all plugin options including the stored access token, the event log table and the scheduled cleanup task. Switching from free to Pro (or back) keeps your configuration – both use the same option keys.
FREE_EVENT_LIMIT constant and free_event_limit_reached(), and resolve_event_platforms(), which enforced the per-event Google/TikTok lock server-side.$is_pro argument of resolve_summary_days(); the constant FREE_SUMMARY_DAYS is now DEFAULT_SUMMARY_DAYS and FREE_LOG_RETENTION_DAYS is gone.load_plugin_textdomain(). WordPress has loaded translations for plugins hosted on WordPress.org by itself since version 4.6. Pixel Made Simple Pro is not distributed through the directory and keeps the call..po/.mo) is no longer shipped. Translations now come from translate.wordpress.org and land in wp-content/languages/; the .pot template stays in the plugin.gtag.js and the three privacy tracker scripts are registered through wp_enqueue_script() instead of being written into the page directly. Plausible's data-domain and Umami's data-website-id are attached through the script_loader_tag filter; Rybbit carries its ID in the query string as before. Nothing changes for the consent gate: without consent the loader still lives as a plain string inside the consent bootstrap and no src attribute reaches the markup.<style> block into a registered stylesheet (wp_add_inline_style()). It had to move from the footer to wp_enqueue_scripts to be printed at all.$_POST themselves, so the obligation to verify the nonce first is visible at the call site.WP_Filesystem, falling back to file_get_contents() on installations without direct filesystem access so the import keeps working there.%i placeholder of $wpdb->prepare() instead of string interpolation. This includes the two queries that read Borlabs Cookie's own tables.async/defer) available to enqueued scripts through the official API instead of a filter of our own.pms to pxms. The directory guidelines require at least four characters, and pms has three. This affects class names, constants, option keys, both database tables, the cron hook, the attribution cookie, order meta keys, AJAX actions, script handles, the JavaScript globals, the CSS classes and the admin page slug – a bookmark to the old settings URL will no longer resolve.pms_capi_blocking is now pxms_capi_blocking, and so on for all of them. There is no compatibility layer. If you hook into one of them from a snippet or a child theme, update the name; in particular pxms_normalize_phone, which decides whether Google receives a phone number at all.Plugin URI and Author URI carried the same address in 0.12.1. They have to differ – the plugin URI describes this plugin, the author URI describes the person who wrote it. Author and Author URI name the author again, as they did before 0.12.1.data-domain, Umami data-website-id, Rybbit as a parameter on the URL); the plugin builds the snippet each one actually expects./umami.js to /script.js in version 2, one of that release's documented breaking changes. And such a failure looks like success: the script loads, and nothing arrives. So copy the address verbatim from your dashboard; the plugin ships no default and never builds one.