capiflow

CapiFlow sends supported WooCommerce events from your server to Meta’s Conversions API (CAPI) — helping reduce the impact of browser-side tracking limitations like ad blockers, Safari ITP, and Firefox ETP.
<h4>Why Server-Side Tracking Matters</h4>
When the Meta pixel is blocked, event data may not reach Meta — affecting ad optimization. CapiFlow complements the browser pixel by sending events server-side with a matching <code>event_id</code> for deduplication.
<h4>How It Works</h4>
<ol>
<li>Install & Activate — Setup wizard launches automatically</li>
<li>Enter Pixel ID + Access Token — From Meta Events Manager</li>
<li>Click Test Connection — Events start flowing</li>
</ol>
No theme edits. No GTM server container required. No separate server-container subscription needed for the built-in Meta CAPI workflow.
<h4>Core Features</h4>
Server-Side Event Tracking
<ul>
<li>🎯 7 Standard Events — Purchase, InitiateCheckout, AddPaymentInfo, AddToCart, ViewContent, Search, PageView</li>
<li>🔄 Deduplication — Browser pixel and server events share the same <code>event_id</code> to support Meta’s deduplication</li>
<li>🛡️ First-Party Event Endpoint — Browser events can be delivered through your own domain where configured</li>
<li>🔐 SHA-256 PII Hashing — Email, phone, name hashed before leaving your server</li>
</ul>
Event Match Quality Support — <code>fbc</code>, <code>fbp</code>, <code>external_id</code>, client IP, user agent, and hashed customer data (email, phone, name) for logged-in users.
Analytics & Monitoring
<ul>
<li>📈 Dashboard — event breakdown and source attribution</li>
<li>🔍 Debug console — payloads and Meta API responses</li>
<li>🏥 System health — token, queue, connection test</li>
<li>🛒 Cart monitor — abandoned cart summary</li>
</ul>
Data Quality & Control
<ul>
<li>📞 Phone validation at checkout</li>
<li>🔒 COD Purchase gate — hold events until admin confirms</li>
<li>📋 Order metabox and columns — per-order CAPI status</li>
</ul>
Developer Tools
<ul>
<li>🔧 Code injection — GTM, analytics, chat widgets (admin-only)</li>
<li>🪝 Filter hooks — <code>capiflow_proxy_url</code>, <code>capiflow_has_tracking_consent</code></li>
<li>📦 HPOS compatible — WooCommerce High-Performance Order Storage support</li>
<li>⏱️ Action Scheduler queue — async event delivery with retry logic</li>
</ul>
<h4>CapiFlow Pro</h4>
CapiFlow Pro is a separate addon that extends the free plugin with:
<ul>
<li>Phone reputation scoring and fraud detection</li>
<li>Negative Purchase events for cancelled/refunded orders</li>
<li>Multi-pixel and category-based pixel routing</li>
<li>COD auto-confirm with courier integration</li>
<li>Real-time EMQ score display from Meta API</li>
<li>Blacklist management for known fraud patterns</li>
<li>Advanced order quality tools</li>
</ul>
Learn more on the <a href="https://capiflowpro.com" rel="nofollow ugc">CapiFlow website</a>.
<h4>Compatibility</h4>
<ul>
<li>Gateways: bKash, Nagad, SSLCommerz, Stripe, PayPal, COD, and all standard WooCommerce gateways</li>
<li>Themes: Any theme — Classic, Block (FSE), page builders</li>
<li>WooCommerce: HPOS and legacy post-based orders</li>
<li>Consent: CookieYes, Complianz, CookieBot, GDPR Cookie Consent, custom filter hook</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.0+</li>
<li>WooCommerce 7.0+</li>
<li>PHP 7.4+</li>
<li>OpenSSL PHP extension</li>
<li>Meta Pixel ID and System User Access Token</li>
</ul>
<h4>External Services</h4>
This plugin connects to the following third-party services:
Meta (Facebook) Conversions API
CapiFlow sends WooCommerce event data to the Meta Conversions API via: <code>https://graph.facebook.com/</code>
This connection is made from your server to Meta’s servers when a configured tracking event occurs. No data is sent until a valid Pixel ID and Access Token are configured.
Data transmitted includes:
<ul>
<li>Hashed email, phone, first and last name (SHA-256)</li>
<li>Client IP address and Browser User Agent</li>
<li>Meta Click ID (_fbc) and Browser ID (_fbp) cookies</li>
<li>Order total, currency, and event metadata</li>
</ul>
All personal data is SHA-256 hashed before transmission.
<ul>
<li><a href="https://www.facebook.com/terms.php" rel="nofollow ugc">Meta Terms of Service</a></li>
<li><a href="https://www.facebook.com/privacy/policy/" rel="nofollow ugc">Meta Privacy Policy</a></li>
<li><a href="https://developers.facebook.com/terms/" rel="nofollow ugc">Meta Platform Terms</a></li>
</ul>
Meta Pixel JavaScript SDK
This plugin loads the Meta Pixel SDK from: <code>https://connect.facebook.net/en_US/fbevents.js</code>
Loaded on frontend pages when a Pixel ID is configured. The SDK is hosted by Meta.
<ul>
<li><a href="https://www.facebook.com/terms.php" rel="nofollow ugc">Meta Terms of Service</a></li>
<li><a href="https://www.facebook.com/privacy/policy/" rel="nofollow ugc">Meta Privacy Policy</a></li>
</ul>
<h4>Privacy</h4>
For server-side events, all personal data is SHA-256 hashed before transmission. For browser events, the Meta Pixel SDK handles hashing via Advanced Matching. This plugin does not store raw PII in its own tables. See <a href="https://www.facebook.com/privacy/policy/" rel="nofollow ugc">Meta’s privacy policy</a>.
<h4>Cookies</h4>
<ul>
<li><code>cs_uid</code> — Random visitor identifier for <code>external_id</code> deduplication. 180 days. No PII.</li>
<li><code>_fbc</code> — Meta Click ID. Set by Meta SDK on ad click. CapiFlow reads/extends server-side. 180 days.</li>
<li><code>_fbp</code> — Meta Browser ID. Set by Meta SDK. CapiFlow reads/extends server-side. 180 days.</li>
</ul>
All cookies are first-party and contain no personally identifiable information.
<h4>Data Storage</h4>
<ul>
<li><code>{prefix}_capiflow_events</code> — Queued/sent event payloads. Auto-purged after delivery.</li>
<li><code>{prefix}_capiflow_analytics</code> — Daily aggregated analytics. Auto-purged by retention settings.</li>
<li>Order metadata with <code>_capiflow_</code> prefix. Removed on uninstall if “Keep Data” is disabled.</li>
<li>Logs in <code>wp-content/uploads/capiflow-logs/</code> with <code>.htaccess</code> protection. Auto-cleaned daily.</li>
</ul>
<h4>Consent</h4>
By default, events fire once configured. Enable “Consent Enforcement” in Settings to respect CMP signals for both browser and server events.
Supported CMPs: CookieYes, Complianz, CookieBot, GDPR Cookie Consent. Custom integration via <code>capiflow_has_tracking_consent</code> filter.
When Consent Enforcement is enabled, browser and server-side events are blocked until valid tracking consent is detected.
Store owners are responsible for lawful consent configuration where required by privacy regulations.

CapiFlow – Conversions API (CAPI) Tracking for WooCommerce

Send WooCommerce events to Meta Conversions API with server-side tracking, deduplication, and confirmed Purchase control.

Khmer Lugod

Foreground Digital

The browser Meta Pixel is broken for ~30% of your visitors after iOS 17 and iOS 18 changed how Apple devices handle tracking. Most marketing managers running WordPress have no easy way to tell if their Pixel + CAPI setup actually works.
This plugin runs a 12-check audit against your site’s front page and gives you a score from 0 to 100, plus plain-English explanations of what each failure means and how to fix it.
Free forever. No signup, no upsell harassment, no phone-home. Every audit runs locally on your server.
Need it fixed for you? If your score is below 85 and you’d rather not learn server-side CAPI from scratch, we offer a flat-fee Pixel Fix service: $497, delivered in 4 business days. One link to that service appears inside the plugin admin only when your score is below 85. The audit works completely whether or not you use the paid option.
What it checks
<ul>
<li>Meta Pixel installed and parseable</li>
<li>Domain verification (iOS 14+ critical)</li>
<li>Pixel events firing (PageView, Purchase, Lead, etc.)</li>
<li>Advanced Matching (the single biggest EMQ lever)</li>
<li>CAPI deduplication via eventID</li>
<li>Consent Mode v2 / cookie banner presence</li>
<li>Google Tag Manager container</li>
<li>fbclid first-party capture (iOS 17 / iOS 18 Link Tracking Protection)</li>
<li>external_id in Advanced Matching (iOS 18 Hide My Email answer)</li>
<li>Server-side CAPI plugin presence</li>
<li>Apple Privacy Manifest readiness (if you link to an iOS app)</li>
<li>HTTPS enforced</li>
</ul>
What it does NOT do
<ul>
<li>No phone-home. Every audit runs on your server against your URL. Nothing is sent to Foreground.</li>
<li>No email capture. No signup wall.</li>
<li>No subscription, no paid tier, no upsell harassment.</li>
<li>No automatic re-runs or cron jobs.</li>
</ul>
Made by Foreground Digital
Foreground is a Dubai-based digital agency. We build Meta Ads campaigns and the server-side infrastructure that catches them — Pixel + CAPI, CRM integrations, WordPress + headless. Founded 2024.
<h3>External services</h3>
This plugin makes ONE outbound HTTP request, and it goes only to your own WordPress site. No data is ever sent to Foreground, Meta, or any other third party.
1. Your own site’s home URL (self-audit request)
<ul>
<li>What it is: A standard HTTP GET request to your site’s own front page (<code>home_url()</code>), used to fetch and parse the public HTML so the plugin can detect Pixel installs, fired events, Advanced Matching, eventID dedupe, etc.</li>
<li>What data is sent: Only the HTTP GET itself. The User-Agent header is set to <code>ForegroundCAPIHealth/1.0 (+https://foreground.agency)</code> to identify the audit traffic in your access logs. No personal data, no admin identifiers, no cookies, no user IDs.</li>
<li>When: Only when a WordPress administrator manually clicks “Run audit on this site” inside Tools → Meta CAPI Health. There is no cron, no front-end trigger, and no automatic re-run.</li>
<li>Where: The request loops back to your own server (the same WordPress installation that has the plugin installed). It does not go to any external service.</li>
<li>Fallback chain: If HTTPS fails due to a local certificate issue, the request is retried once with <code>sslverify=false</code>, and as a last resort over <code>http://</code> to the same hostname. This is purely a local recovery path; no external host is ever contacted.</li>
</ul>
2. References to third-party services in the plugin’s UI (documentation only — no external call)
The plugin’s “How to fix” instructions name several third-party services so administrators know where to go in their existing accounts. The plugin does not connect to any of these. They are mentioned for instructional purposes only:
<ul>
<li>Meta / Facebook — <code>connect.facebook.net</code>, <code>graph.facebook.com</code>, Meta Events Manager, Meta Business Manager. Used as documentation references when explaining how to install a Meta Pixel, set up domain verification, or wire Conversions API. The plugin does not call any Meta endpoint. Meta’s terms: https://www.facebook.com/legal/terms — Meta’s privacy policy: https://www.facebook.com/privacy/policy</li>
<li>Third-party WordPress plugins mentioned by name in the fix steps (PixelYourSite, Meta for WordPress, CAPI Suite, Cookiebot, CookieYes, Complianz, Termly, Iubenda, OneTrust, GTM for WordPress). These are recommendations only. The plugin does not call, depend on, or communicate with any of them.</li>
<li>Foreground.agency — appears in the audit traffic User-Agent string for self-identification, and as the destination of an optional “Get the Pixel Fix” link shown in the admin UI only when an administrator clicks it. The plugin itself does not phone home to foreground.agency. Foreground privacy policy: https://foreground.agency/privacy</li>
</ul>
The “Fix it for me” CTA shown when an administrator’s score is below 85 is a plain HTML link that opens <code>https://foreground.agency/pixel-fix/?ref=wp-plugin</code> in a new tab. Nothing is transmitted unless the administrator chooses to click it.

Foreground CAPI Health Check

Audit your site's Meta Pixel + Conversions API setup. 12 checks against the 2026 iOS 17/18 stack. Free, no signup, no phone-home.

CapiFlow – Conversions API (CAPI) Tracking for WooCommerce vs Foreground CAPI Health Check