Plainer wording on the settings screens. From 3.8.x you also get 3.9.0-3.9.1: hashed contact details kept up to 180 days, two first-party cookies, and a new privacy-policy section to review. An unanswered consent banner now counts as no consent, so match quality may read lower than before.<\/p>","3.9.1":"
Fixes identity records being orphaned by a security-salt rotation (WordPress secret keys changed), pruning them safely now. By-IP column labels, GTM manual, and DSAR export labels are clearer. A one-time review request appears after your first successful Purchase. No action needed.<\/p>","3.9.0":"
This release stores hashed contact details for up to 180 days to improve ad match quality, and sets two first-party cookies. Nothing is stored where marketing consent is refused \u2014 and minting a visitor identifier is now consent-gated too, so on a CMP-equipped store with consent unanswered, guests get NO external_id where 3.8.1 minted one unconditionally; you may see PageView match quality fall after updating. Review your privacy policy \u2014 the plugin now contributes its own section to the one WordPress generates.<\/p>","3.8.1":"
Fixes an order paid after checkout reporting your server's own IP address as the\ncustomer's, which cost match quality on every purchase through a redirect payment\ngateway, and a related issue where updating an order's status yourself in wp-admin\ncould attach your own browsing identity to that customer's purchase. Also sends more\nidentifying detail with each event, all of it respecting existing consent settings.\nNo action needed.<\/p>","3.8.0":"
Critical: GTM template re-import required \u2014 TikTok double-counting otherwise.<\/strong> TikTok\nrenamed its event names in 2025 ( Hotfix for a 3.7.1 dispatch-halt regression.<\/strong> Sites where Action Scheduler marked Browser-side AddToCart dataLayer push restored on themes that don't render a WC cart widget (was silently lost \u2014 server-side CAPI was always firing). Behavioral bot filter no longer leaks 3-5 event burst patterns into trusted state. Two small admin hygiene fixes.<\/p>","3.7.0":" Event Log gains a By-IP grouped view and customer-protection badges that prevent excluding real buyers by mistake. AI crawlers (GPTBot, PerplexityBot, ClaudeBot, etc.) classified separately from bots with their own counter on the Dashboard. Block-list terminology clarified to Exclude (it filters CAPI dispatch, not site access). Google Ads Enhanced Conversions and Pinterest TikTok CAPI added. Plugin renamed to CAPI Suite. Behavioral bot detection (VPN shoppers no longer misclassified). Blocklist DB tables (IPv4+IPv6) with per-source toggle and one-click CIDR block on Event Log rows. CCPA toggle. Re-import the GTM template for TikTok tags.<\/p>","3.5.3":" Reliability fixes. (1) Spurious AJAX add_to_cart events from sessionStorage fragment replay eliminated. (2) Per-platform queue retry: only the failing side is retried. (3) Event Log captures User Agent, supports date-range filtering, retention configurable. No GTM template change.<\/p>","3.5.2":" Critical: GTM template re-import required.<\/strong> Bundled template migrated to modern GTM API schema. Older templates rejected with "File format invalid"\/"Unknown entity type". Re-download and re-import in Merge mode. Plugin runtime unchanged.<\/p>","3.5.1":" Critical hotfix.<\/strong> v3.5.0's CMP detection helper called class_exists() without disabling autoload, triggering CookieYes \/ Cookie Law Info fatal errors (white screen). Update immediately if you have either plugin installed.<\/p>","3.5.0":" GTM template re-import required.<\/strong> Fixes import-error bug ("Unrecognized value [customEvent]"). Adds Consent Mode v2, CMP auto-block exemptions (CookieYes\/Cookiebot\/Complianz), and WooCommerce Subscriptions integration. Server-side CAPI unchanged.<\/p>","3.4.2":" Action required for existing installs.<\/strong> Fixes a GA4-schema bug causing Meta Events Manager to reject browser-tag parameters. Re-import the GTM template ("Merge" mode) OR add two new Custom JavaScript variables manually.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3528853,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3528853,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3528853,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3528853,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.3.0","3.4.0","3.4.1","3.4.2","3.5.0","3.5.1","3.5.2","3.5.3","3.6.0","3.7.0","3.7.1","3.7.2","3.8.0","3.8.1","3.9.2"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[262246],"plugin_tags":[195844,7855,207498,167802,179062],"plugin_category":[45],"plugin_contributors":[247430],"plugin_business_model":[],"class_list":["post-249247","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-conversions-api","plugin_tags-facebook-pixel","plugin_tags-meta-pixel","plugin_tags-pinterest-tag","plugin_tags-tiktok-pixel","plugin_category-ecommerce","plugin_contributors-suhanduman","plugin_committers-suhanduman"],"banners":{"banner":"https:\/\/ps.w.org\/easy-meta-capi\/assets\/banner-772x250.png?rev=3528853","banner_2x":"https:\/\/ps.w.org\/easy-meta-capi\/assets\/banner-1544x500.png?rev=3528853","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/easy-meta-capi\/assets\/icon-128x128.png?rev=3528853","icon_2x":"https:\/\/ps.w.org\/easy-meta-capi\/assets\/icon-256x256.png?rev=3528853","generated":false},"screenshots":[],"raw_content":"\n Meta Pixel, Pinterest and TikTok, sent server-side, in one free plugin.<\/strong> A bundled Google Tag Manager template covers browser-side tracking. Sixteen events you switch on individually \u2014 PageView, ViewContent, ViewCategory, SelectItem, AddToCart, ViewCart, InitiateCheckout, AddShippingInfo, AddPaymentInfo, Purchase, Search, CompleteRegistration, AddToWishlist, Lead, Login and Comment \u2014 plus subscription renewals handled on their own terms. Classic and block-based checkout, HPOS compatible, each platform retried independently on failure. No cloud server to rent, no premium tier to unlock, no event limit.<\/p>\n\n Your match quality climbs on its own after you update.<\/strong> Twenty identity parameters are assembled per event and normalised exactly the way Meta requires before they are hashed. The hashed keys are then remembered for up to 180 days behind a consent gate, so a returning visitor arrives already identified instead of anonymous. Nothing raw is ever written to disk: only salted SHA-256 hashes, which survive even a WordPress security-key rotation.<\/p>\n\n Attribution survives the whole journey, not just the click.<\/strong> Eight click identifiers are captured and kept \u2014 Bots don't get counted as customers \u2014 and real shoppers on a VPN still are.<\/strong> Datacenter ranges are weighed against actual browser behaviour: mouse movement, scrolling, and whether a cart ever appears. A doubtful visit is held rather than thrown away, and if that visitor goes on to act like a real person, the whole funnel is released and reported retroactively. Purchases are never held back while any of this is decided. Apple iCloud Private Relay and corporate VPN egress ranges are recognised as real people, not as datacenters.<\/p>\n\n Safari visitors stay attributable for 90 days, not 7.<\/strong> The cookie is written by the server, so Safari's seven-day cap on script-written cookies stops resetting the visitor every week.<\/p>\n\n Your orders are counted once, not twice.<\/strong> The same event ID goes out browser-side and server-side within Meta's 48-hour deduplication window, so each platform matches them up instead of double-counting. A browser event that falls outside the window is suppressed rather than sent as a second conversion.<\/p>\n\n You keep your analytics when a visitor declines cookies.<\/strong> The event still goes through for counting, with personal details stripped out first. Five consent platforms are recognised automatically \u2014 CookieYes, Cookiebot, Complianz, iubenda and Termly \u2014 and a filter covers anything else, including OneTrust, Usercentrics and hand-rolled banners.<\/p>\n\n To match server-side conversion events to the right person, the plugin stores SHA-256 hashes<\/strong> of contact details a visitor provides \u2014 email, phone, name and address components \u2014 against an opaque visitor identifier. Raw contact details are never written to disk<\/strong>; values are hashed before storage and the hash cannot be reversed.<\/p>\n\n This plugin is free. Not \"free with limits\" \u2014 just free. Every feature works, there is no pro version waiting behind a paywall, and the code is GPL, so you can read every line that touches your customers' data.<\/p>\n\n This plugin connects your website to external services to send event data.<\/p>\n\n Shared hosting note.<\/strong> Some restrictive shared hosts block outbound HTTPS by default. If event delivery silently fails after install, ask your host to whitelist the following domains for outgoing connections: This plugin is an independent, community-driven implementation of server-side Conversions API protocols. It is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc., TikTok Ltd., Pinterest, Inc., Google LLC, Automattic Inc., or any other trademark holder referenced herein.<\/p>\n\n \"Meta\", \"Facebook\", and the Meta Pixel are trademarks of Meta Platforms, Inc. \"TikTok\" is a trademark of TikTok Ltd. \"Pinterest\" is a trademark of Pinterest, Inc. \"Google Tag Manager\", \"Google Ads\", and \"GA4\" are trademarks of Google LLC. \"WooCommerce\" is a trademark of Automattic Inc. All trademark references are used solely for descriptive interoperability purposes \u2014 to indicate which platforms this plugin can transmit data to under the merchant's own configured credentials.<\/p>\n\n No user data is transmitted to any external service until the merchant explicitly configures their own platform credentials in the plugin settings. The plugin does not \"phone home\" or contact any developer-controlled server. The only outbound HTTP calls are: (1) merchant-configured CAPI endpoints, (2) the public CIDR manifests at raw.githubusercontent.com used by the optional Datacenter IP filter \u2014 no visitor data is sent in those manifest fetches.<\/p>\n\n\n Server-side events start flowing on the next page view. Send a test from Event Management \u2192 Test Modes<\/strong> to verify credentials before going live.<\/p>\n\n To prevent duplicate browser+server events:<\/p>\n\n The bundled GTM template ships GA4 + Meta tags pre-wired to the GA4 ecommerce dataLayer, plus TikTok tags that read from a If you cannot import the JSON template (locked container, workspace permissions) or want to set up GTM manually, the full step-by-step walkthrough ships with the plugin at Open CAPI Suite \u2192 Event Log<\/strong> after browsing your store. Successful dispatches show as \"Success (Meta)\" \/ \"Success (TikTok)\" \/ \"Success (Pinterest)\". The Dashboard widget shows queue health at a glance.<\/p>\n\n If the log stays empty, a JS optimizer is probably deferring the plugin's inline scripts \u2014 see the cache-plugin FAQ. Detailed GTM setup, Google Ads Enhanced Conversions, and other platform tags live in Setup details for Consent Mode v2, the strict server-side consent mode (GDPR PII gating), CMP auto-block compatibility, and the WooCommerce Subscriptions integration. None of these are required for a basic CAPI setup \u2014 turn them on as your store needs them.<\/p>\n\n If you serve EU visitors, GA4 and Meta browser tags don't fire when consent is denied \u2014 typically losing 20\u201350% of measured event volume<\/strong>. Google Consent Mode v2 recovers this: when consent is denied, GA4 \/ Meta tags switch to cookieless pings<\/strong> (anonymous beacons carrying event name, value, currency, timestamp but no client identifier). Google's ML models the conversions from these pings and shows them mixed with observed ones in your reports. A single CMP integration repairs both GA4 and Meta attribution because the Meta Pixel template reads the same consent signals.<\/p>\n\n How to enable.<\/strong> Popular CMP plugins (Cookiebot, CookieYes, Complianz, Iubenda, Termly, OneTrust) all have a native Consent Mode v2 toggle in their settings \u2014 find and enable it. The CMP then calls The bundled GTM template includes a paused \"Consent Defaults (Pre-CMP)\"<\/strong> tag. Enable it only if your CMP doesn't set Consent Mode v2 only controls browser<\/strong> tags. Server-side CAPI fires from PHP, never sees The Privacy & Consent (Server-side)<\/strong> section has a Strict server-side consent toggle (default OFF). When enabled and the visitor has denied marketing consent in your CMP, identifying PII ( Why this matters alongside Consent Mode v2.<\/strong> Denied-consent browser pixels switch to cookieless pings \u2014 modeled, not observed. With Strict server-side consent ON, your server-side CAPI ships alongside that ping carrying the same Default OFF preserves match quality for existing non-EU setups. Recommended ON once Consent Mode v2 is configured in your CMP.<\/p>\n\n CMPs with \"auto-blocking\" (Cookiebot, CookieYes, others) scan every By default, every WooCommerce Subscriptions auto-renewal sends a fresh The plugin auto-detects WooCommerce Subscriptions and exposes:<\/p>\n\n Subscription Renewal Behavior<\/strong> (radio):<\/p>\n\n Tag every Purchase with customer_status<\/strong> (checkbox): adds Behind a trusted reverse proxy, the real-IP resolver walks The plugin cannot detect this misconfiguration or infer your real proxy hop count on its own. If you know it \u2014 one hop for a single reverse proxy, more for a CDN plus a local proxy \u2014 set it with the This bounds how many trailing hops the walk will ever treat as trusted-and-skippable; once that many are skipped it stops rather than continuing further left, so a crafted filler hop beyond the boundary can no longer push an attacker-chosen address through. Default is unbounded (today's behaviour) \u2014 leave it unset unless you are certain of your topology, since too low a value can make the walk stop before reaching a real client hop.<\/p>\n\n\nCompletePayment<\/code> \u2192 Purchase<\/code>, SubmitForm<\/code> \u2192 Lead<\/code>); the\nserver-side CAPI call sends the new name, but the bundled GTM template's TikTok Purchase tag\nstill sent the retired CompletePayment<\/code> name until this release. TikTok deduplicates browser\nand server events by event name plus event_id<\/code> \u2014 with the two sides disagreeing, dedup never\nmatched and every TikTok purchase reported twice<\/strong>. Re-download gtm-template.json<\/code> from\nMain Settings and re-import your GTM container in Merge<\/strong> mode (or edit the "TikTok -\nPurchase" tag's Event Name to Purchase<\/code> manually \u2014 see docs\/GTM-MANUAL-SETUP.txt<\/code>).\nBehaviour change: Purchase now waits for a paid order status.<\/strong> Previously a Purchase was\nsent as soon as the order-received page loaded, even when payment had failed \u2014 so an\nabandoned payment at a redirect gateway still counted as a sale in Meta. It is now sent when\nthe order reaches a paid status (by default whatever WooCommerce treats as paid, plus On\nhold), and if that happens later the event is sent then, even if the customer never returns.\nStores with a custom order status should check Event Management \u2192 Send Purchase when the\norder is<\/strong> after updating; a one-time notice points you there. Also fixes a bug where one\nstale queued event could silently discard a whole batch of valid ones. Also corrects\nidentity-field normalization, so hashed customer data actually matches, and keeps ad-click\nIDs attached to orders that are paid after checkout.<\/p>","3.7.2":"mcapi_process_event_queue<\/code> as "failed after 300 seconds" auto-recover on update. Plus three additional bot\/human detection signals: Cloudflare Bot Management score header (if you forward it to your origin), navigator.webdriver<\/code> browser-automation flag, and ip_state.human_score >= 100<\/code> strong-trust now qualifies as a Customer signal on its own.<\/p>","3.7.1":"_epik<\/code> capture continue from earlier work \u2014 re-import the GTM template if you haven't yet. One additive DB column on upgrade (instant DDL on InnoDB 5.7+ \/ MariaDB 10.3+).<\/p>","3.6.0":"fbclid<\/code>, gclid<\/code>, wbraid<\/code>, gbraid<\/code>, ttclid<\/code>, pina_id<\/code>, _epik<\/code> and _ttp<\/code> \u2014 written into first-party cookies client-side so a cached landing page never loses them, then persisted onto the order so a payment that completes days later is still credited to the campaign that earned it. Subscription renewals inherit the original order's identifiers instead of being credited to a fresh ad.<\/p>\n\nBuilt like infrastructure, not like a tracking snippet<\/h4>\n\n
\n
What this plugin stores<\/h4>\n\n
\n
_fbp<\/code> (90 days).<\/li>\nmcapi_identity_retention_days<\/code>.<\/li>\nOur Philosophy<\/h3>\n\n
External Services<\/h3>\n\n
\n
\n
\n
\n
\n
raw.githubusercontent.com\/rezmoss\/cloud-provider-ip-addresses<\/code>\n\n\n
raw.githubusercontent.com\/rezmoss\/cloud-provider-ip-addresses<\/code> source (folder apple_private_relay\/<\/code>)\n\n\n
graph.facebook.com<\/code>, business-api.tiktok.com<\/code>, api.pinterest.com<\/code>, and raw.githubusercontent.com<\/code> (only needed if you keep \"Auto-fetched\" enabled on the Blocked Traffic tab \u2014 covers both the datacenter blocklist and the Apple Private Relay whitelist).<\/p>\n\nDisclaimer<\/h3>\n\n
Quick start (3 steps)<\/h3>\n\n
\n
gtm-template.json<\/code> from the GTM Container ID<\/strong> box, import it into your GTM container in Merge<\/strong> mode, set the pixel-code constants to your real IDs, and publish.<\/li>\n<\/ol>\n\nRecommended GTM dedup configuration<\/h3>\n\n
\n
FB_<\/code>.<\/li>\n<\/ol>\n\nCONST - TikTok Pixel Code<\/code> variable. Pinterest tags are added manually because the Community Template can fail to import inside container exports.<\/p>\n\nwp-content\/plugins\/easy-meta-capi\/docs\/GTM-MANUAL-SETUP.txt<\/code>.<\/p>\n\nVerify<\/h3>\n\n
docs\/GTM-MANUAL-SETUP.txt<\/code>. Consent Mode v2, Strict server-side consent, CMP auto-block, and WC Subscriptions are documented under Advanced Configuration<\/strong> below.<\/p>\n\nAdvanced Configuration<\/h4>\n\n
Consent Mode v2 Setup (GDPR \/ EU Compliance)<\/h3>\n\n
gtag('consent', 'default', {denied})<\/code> before GTM loads and gtag('consent', 'update', {granted})<\/code> after the visitor accepts.<\/p>\n\ngtag('consent', 'default', ...)<\/code> on its own (rare with modern CMPs).<\/p>\n\nStrict server-side consent mode (PII gating for CAPI)<\/h3>\n\n
gtag('consent', ...)<\/code> signals \u2014 so it transmits hashed PII regardless of cookie-banner choice. Fine outside the EU; a GDPR concern inside it.<\/p>\n\nem<\/code>, ph<\/code>, fn<\/code>, ln<\/code>, address, fbp<\/code>, fbc<\/code> \u2026) is stripped from the CAPI payload. The event still ships with event_id<\/code>, value<\/code>, currency<\/code>, contents<\/code> \u2014 Cookiebot, CookieYes, and Complianz cookies are read automatically; other CMPs supply state via the mcapi_marketing_consent_granted<\/code> filter.<\/p>\n\nevent_id<\/code>. Meta dedupes by event_id<\/code> and now has an observed<\/strong> server signal feeding the same conversion record the cookieless ping created \u2014 cleaner Event Match Quality than browser-only or na\u00efve \"send everything\" CAPI, and GDPR-defensible because no identifying data leaves your server.<\/p>\n\nCMP Auto-Blocking and the Plugin's Inline Scripts<\/h3>\n\n
<script><\/code> tag on load and convert anything they suspect of tracking to type=\"text\/plain\"<\/code> until consent. The plugin's inline scripts only POST first-party events to your own REST endpoint \u2014 but a generic auto-blocker can't tell. To avoid a silent break, every plugin-rendered inline script ships with opt-out attributes for Cookiebot (data-cookieconsent=\"ignore\"<\/code>), CookieYes (data-cookieyes=\"cookieyes-necessary\"<\/code>), and Complianz (data-cmplz-no-cookielaw=\"1\"<\/code>). For other CMPs (OneTrust, Quantcast, in-house), append your own attribute via the mcapi_inline_script_attrs<\/code> filter.<\/p>\n\nWooCommerce Subscriptions Integration<\/h3>\n\n
Purchase<\/code> to Meta CAPI \u2014 credited to the original acquisition ad. Reported ROAS keeps climbing month after month from the same conversion, polluting optimization signals.<\/p>\n\n\n
Purchase<\/code>. Existing setups unchanged.<\/li>\nPurchase<\/code> but with custom_data.customer_status = \"subscription_renewal\"<\/code> so you can filter them in Events Manager.<\/li>\nSubscribe<\/code> for sign-ups + a SubscriptionRenewal<\/code> custom event for renewals. Purchase<\/code> stays clean, advertisers using LTV-bidding can opt into both.<\/li>\n<\/ul>\n\ncustom_data.customer_status<\/code> (new_customer<\/code> \/ returning_customer<\/code> \/ subscription_renewal<\/code>) to every Purchase<\/code> so Meta Advantage+ can bid acquisition vs. retention differently. Guest checkouts fall back to billing-email lookup.<\/p>\n\nX-Forwarded-For Hop Count (advanced proxy setups)<\/h3>\n\n
X-Forwarded-For<\/code> from the right, skipping entries that look like trusted infrastructure (a known proxy CIDR or a private\/reserved address), and uses the first one that doesn't. This defeats the common attack of forging a leftmost entry, but it has a residual gap: if your proxy is configured to pass X-Forwarded-For<\/code> through unmodified<\/strong> instead of appending the hop it actually witnessed (nginx's proxy_set_header X-Forwarded-For $http_x_forwarded_for<\/code> instead of $proxy_add_x_forwarded_for<\/code> is the classic case), every entry in the header is client-controlled \u2014 a visitor can append a filler value that merely resembles<\/em> infrastructure (e.g. a private-looking address) and have an earlier, forged entry accepted as their IP instead.<\/p>\n\nmcapi_trusted_proxy_hops<\/code> filter:<\/p>\n\nadd_filter( 'mcapi_trusted_proxy_hops', function() { return 1; } );\n<\/code><\/pre>\n\n\n
Does this plugin replace the Meta Pixel?<\/h3><\/dt>\n