Hugo Carvalho

<p>Attribution usually breaks somewhere between the ad click and the conversion. ClickTrail makes it survive: cached pages, dynamic forms, multi-page journeys, repeat visits, and consent requirements.</p>
<p>ClickTrail keeps the source of the visit, not a profile of the visitor. Capture is first-party and consent-aware: the plugin does not call external services to identify or enrich visitors, and data only leaves your site through integrations you enable yourself (GTM, webhooks, server-side delivery).</p>
<p>ClickTrail stores first-touch and last-touch attribution from the landing page and keeps it available until the conversion point, where it becomes usable inside WordPress:</p>
<ul>
<li>WooCommerce orders</li>
<li>supported forms</li>
<li>browser events</li>
<li>optional server-side delivery</li>
</ul>
<p>In WooCommerce, ClickTrail stores attribution on the order, pushes enriched purchase events on the thank-you page, and can optionally emit GA4-style storefront events for <code>view_item</code>, <code>view_item_list</code>, <code>view_cart</code>, <code>add_to_cart</code>, <code>remove_from_cart</code>, and <code>begin_checkout</code>, plus post-purchase milestones, through the same ClickTrail pipeline.</p>
<h4>Pick a starting path</h4>
<ul>
<li><strong>WooCommerce store</strong>: enable Capture and WooCommerce. Orders carry campaign context from day one; add storefront events later if you want funnel signals.</li>
<li><strong>Lead-gen forms</strong>: enable Capture and Forms. Contact Form 7 and Fluent Forms get hidden fields automatically; Gravity Forms and WPForms fill the <code>ct_*</code> fields you add.</li>
<li><strong>GTM / sGTM stack</strong>: enable Capture, Events, and Delivery. Browser events push to the <code>dataLayer</code>, and the server-side adapters feed sGTM or platform APIs directly.</li>
</ul>
<h4>What problems it solves</h4>
<ul>
<li><strong>No paid order reports as “direct”</strong>: Paid traffic often ends up looking like direct traffic by the time an order is placed. ClickTrail stores attribution on the order and keeps purchase reporting tied to campaign context.</li>
<li><strong>No checkout journey goes dark</strong>: WooCommerce storefront journeys can emit opt-in <code>view_item</code>, <code>view_item_list</code>, <code>view_cart</code>, <code>add_to_cart</code>, <code>remove_from_cart</code>, and <code>begin_checkout</code> signals through the same ClickTrail event layer used elsewhere in the plugin.</li>
<li><strong>No cached or AJAX-rendered form drops attribution</strong>: Hidden fields often break on cached pages or dynamically rendered forms. ClickTrail includes client-side fallback and dynamic-content support.</li>
<li><strong>No cross-domain hop breaks continuity</strong>: Approved link decoration and attribution tokens keep continuity between domains or subdomains.</li>
<li><strong>No consent signal is ignored</strong>: Consent controls, browser events, webhook intake, and server-side transport live in the same plugin and respect the same consent state.</li>
</ul>
<h4>Core capabilities</h4>
<ul>
<li><strong>Capture</strong>: first-touch and last-touch UTMs, major ad click IDs, and referrers with automatic organic/social/referral fallback when UTMs are absent.</li>
<li><strong>WooCommerce</strong>: checkout attribution persistence, thank-you purchase event push, enriched commerce payloads, optional storefront commerce events, and optional order-status milestones.</li>
<li><strong>Forms</strong>: automatic hidden-field enrichment for Contact Form 7 and Fluent Forms, compatible hidden-field population for Gravity Forms and WPForms, client-side fallback, dynamic form support, and WhatsApp attribution continuity.</li>
<li><strong>Events</strong>: browser event collection with <code>dataLayer</code> pushes, canonical REST intake, webhook ingestion, lifecycle updates, one-time WordPress follow-up events such as <code>login</code>, <code>sign_up</code>, and <code>comment_submit</code>, and optional WooCommerce storefront events.</li>
<li><strong>Delivery</strong>: optional server-side transport, retry queue, diagnostics, consent-aware dispatch, and failure telemetry.</li>
</ul>
<h4>Recent additions</h4>
<p>Recent releases extended the Gravity Forms integration with channel classification, merge tags, and per-form controls:</p>
<ul>
<li><strong>Channel classification</strong>: every GF entry now receives a <code>ct_ft_channel</code> value — a human-readable label such as Google Ads, ChatGPT, or Mailchimp — derived from click IDs, UTM parameters, or referrer context. A server-side fallback covers sessions where JS attribution was unavailable.</li>
<li><strong>Expanded click ID capture</strong>: six additional click IDs (Reddit <code>rdt_cid</code>, Pinterest <code>pin_cid</code>, Snapchat <code>snap_cid</code>, Mailchimp <code>mc_cid</code> / <code>mc_eid</code>, and Display & Video 360 <code>dclid</code>) are now captured and stored.</li>
<li><strong>Merge tags</strong>: nine <code>{clicutcl_*}</code> merge tags are available in GF notifications and confirmations, including <code>{clicutcl_channel}</code>, <code>{clicutcl_click_id}</code>, and seven UTM-based tags.</li>
<li><strong>Per-form toggle</strong>: attribution tracking can be enabled or disabled per form via a dedicated ClickTrail section in Gravity Forms form settings.</li>
<li><strong>Admin QA mode</strong>: attribution data is stored in <code>sessionStorage</code> only when a <code>manage_options</code> user is logged in, preventing admin browsing from appearing in attribution reports.</li>
<li><strong>sessionStorage fallback</strong>: attribution capture now falls back to <code>sessionStorage</code> when the browser blocks cookies.</li>
<li><strong>Minification protection</strong>: ClickTrail script tags carry exclusion attributes recognised by Autoptimize, Cloudflare Rocket Loader, WP Rocket, and LiteSpeed Cache (corrected attribute set in 1.7.0).</li>
</ul>
<h4>Current admin structure</h4>
<p>The main settings experience is organized by capability:</p>
<ul>
<li>Capture</li>
<li>Forms</li>
<li>Events</li>
<li>Delivery</li>
</ul>
<p>Operational screens stay separate:</p>
<ul>
<li>Logs</li>
<li>Diagnostics</li>
</ul>
<h4>Supported integrations</h4>
<ul>
<li><strong>Forms</strong>: Contact Form 7, Elementor Forms (Pro), Fluent Forms, Gravity Forms, Ninja Forms, WPForms</li>
<li><strong>Commerce</strong>: WooCommerce</li>
<li><strong>CMP sources</strong>: ClickTrail banner, Cookiebot, OneTrust, Complianz, GTM, custom</li>
<li><strong>Webhook providers</strong>: Calendly, HubSpot, Typeform</li>
<li><strong>Server-side adapters</strong>: Generic collector, sGTM, Meta CAPI, Google Ads / GA4, LinkedIn CAPI, Pinterest Conversions API, TikTok Events API</li>
</ul>
<h4>Forms behavior by plugin</h4>
<ul>
<li><strong>Contact Form 7 and Fluent Forms</strong>: ClickTrail can add hidden attribution fields automatically.</li>
<li><strong>Gravity Forms and WPForms</strong>: ClickTrail can populate matching hidden fields you add to the form.</li>
<li><strong>Recommended for Gravity Forms and WPForms</strong>: add the hidden fields you want stored or exported, and ClickTrail will fill them.</li>
<li><strong>Elementor Forms (Pro)</strong>: ClickTrail uses the available submission hooks and attribution fallback, not automatic hidden-field injection.</li>
<li><strong>Ninja Forms</strong>: ClickTrail stores attribution with the submission and surfaces it in the submission record, not as automatic hidden-field injection.</li>
</ul>
<h4>Supported click IDs</h4>
<ul>
<li>Google: <code>gclid</code>, <code>wbraid</code>, <code>gbraid</code></li>
<li>Meta: <code>fbclid</code></li>
<li>TikTok: <code>ttclid</code></li>
<li>Microsoft: <code>msclkid</code></li>
<li>X / Twitter: <code>twclid</code></li>
<li>LinkedIn: <code>li_fat_id</code></li>
<li>Snapchat: <code>sccid</code></li>
<li>Pinterest: <code>epik</code></li>
</ul>
<h4>Additional capture fields</h4>
<ul>
<li>Extended UTMs: <code>utm_id</code>, <code>utm_source_platform</code>, <code>utm_creative_format</code>, <code>utm_marketing_tactic</code></li>
<li>Browser/platform identifiers: <code>fbc</code>, <code>fbp</code>, <code>_ttp</code>, <code>li_gc</code>, <code>ga_client_id</code>, <code>ga_session_id</code></li>
</ul>


ClickTrail – UTM, Click ID & Ad Tracking (with Consent)

Consent-aware attribution for WooCommerce, WordPress forms, and event flows. Capture UTMs and click IDs across conversion paths.

capiflow

<p><strong>CapiFlow</strong> sends supported WooCommerce events from your server to Meta’s Conversions API (CAPI) — helping reduce the impact of browser-side tracking limitations like ad blockers, Safari ITP, and Firefox ETP.</p>
<h4>Why Server-Side Tracking Matters</h4>
<p>When the Meta pixel is blocked, event data may not reach Meta — affecting ad optimization. CapiFlow complements the browser pixel by sending events server-side with a matching <code>event_id</code> for deduplication.</p>
<h4>How It Works</h4>
<ol>
<li><strong>Install & Activate</strong> — Setup wizard launches automatically</li>
<li><strong>Enter Pixel ID + Access Token</strong> — From Meta Events Manager</li>
<li><strong>Click Test Connection</strong> — Events start flowing</li>
</ol>
<p>No theme edits. No GTM server container required. No separate server-container subscription needed for the built-in Meta CAPI workflow.</p>
<h4>Core Features</h4>
<p><strong>Server-Side Event Tracking</strong></p>
<ul>
<li>🎯 <strong>7 Standard Events</strong> — Purchase, InitiateCheckout, AddPaymentInfo, AddToCart, ViewContent, Search, PageView</li>
<li>🔄 <strong>Deduplication</strong> — Browser pixel and server events share the same <code>event_id</code> to support Meta’s deduplication</li>
<li>🛡️ <strong>First-Party Event Endpoint</strong> — Browser events can be delivered through your own domain where configured</li>
<li>🔐 <strong>SHA-256 PII Hashing</strong> — Email, phone, name hashed before leaving your server</li>
</ul>
<p><strong>Event Match Quality Support</strong> — <code>fbc</code>, <code>fbp</code>, <code>external_id</code>, client IP, user agent, and hashed customer data (email, phone, name) for logged-in users.</p>
<p><strong>Analytics & Monitoring</strong></p>
<ul>
<li>📈 Dashboard — event breakdown and source attribution</li>
<li>🔍 Debug console — payloads and Meta API responses</li>
<li>🏥 System health — token, queue, connection test</li>
<li>🛒 Cart monitor — abandoned cart summary</li>
</ul>
<p><strong>Data Quality & Control</strong></p>
<ul>
<li>📞 Phone validation at checkout</li>
<li>🔒 COD Purchase gate — hold events until admin confirms</li>
<li>📋 Order metabox and columns — per-order CAPI status</li>
</ul>
<p><strong>Developer Tools</strong></p>
<ul>
<li>🔧 Code injection — GTM, analytics, chat widgets (admin-only)</li>
<li>🪝 Filter hooks — <code>capiflow_proxy_url</code>, <code>capiflow_has_tracking_consent</code></li>
<li>📦 HPOS compatible — WooCommerce High-Performance Order Storage support</li>
<li>⏱️ Action Scheduler queue — async event delivery with retry logic</li>
</ul>
<h4>CapiFlow Pro</h4>
<p>CapiFlow Pro is a separate addon that extends the free plugin with:</p>
<ul>
<li>Phone reputation scoring and fraud detection</li>
<li>Negative Purchase events for cancelled/refunded orders</li>
<li>Multi-pixel and category-based pixel routing</li>
<li>COD auto-confirm with courier integration</li>
<li>Real-time EMQ score display from Meta API</li>
<li>Blacklist management for known fraud patterns</li>
<li>Advanced order quality tools</li>
</ul>
<p>Learn more on the <a href="https://capiflowpro.com" rel="nofollow ugc">CapiFlow website</a>.</p>
<h4>Compatibility</h4>
<ul>
<li><strong>Gateways:</strong> bKash, Nagad, SSLCommerz, Stripe, PayPal, COD, and all standard WooCommerce gateways</li>
<li><strong>Themes:</strong> Any theme — Classic, Block (FSE), page builders</li>
<li><strong>WooCommerce:</strong> HPOS and legacy post-based orders</li>
<li><strong>Consent:</strong> CookieYes, Complianz, CookieBot, GDPR Cookie Consent, custom filter hook</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.0+</li>
<li>WooCommerce 7.0+</li>
<li>PHP 7.4+</li>
<li>OpenSSL PHP extension</li>
<li>Meta Pixel ID and System User Access Token</li>
</ul>
<h4>External Services</h4>
<p>This plugin connects to the following third-party services:</p>
<p><strong>Meta (Facebook) Conversions API</strong></p>
<p>CapiFlow sends WooCommerce event data to the Meta Conversions API via: <code>https://graph.facebook.com/</code></p>
<p>This connection is made from your server to Meta’s servers when a configured tracking event occurs. No data is sent until a valid Pixel ID and Access Token are configured.</p>
<p>Data transmitted includes:</p>
<ul>
<li>Hashed email, phone, first and last name (SHA-256)</li>
<li>Client IP address and Browser User Agent</li>
<li>Meta Click ID (_fbc) and Browser ID (_fbp) cookies</li>
<li>Order total, currency, and event metadata</li>
</ul>
<p>All personal data is SHA-256 hashed before transmission.</p>
<ul>
<li><a href="https://www.facebook.com/terms.php" rel="nofollow ugc">Meta Terms of Service</a></li>
<li><a href="https://www.facebook.com/privacy/policy/" rel="nofollow ugc">Meta Privacy Policy</a></li>
<li><a href="https://developers.facebook.com/terms/" rel="nofollow ugc">Meta Platform Terms</a></li>
</ul>
<p><strong>Meta Pixel JavaScript SDK</strong></p>
<p>This plugin loads the Meta Pixel SDK from: <code>https://connect.facebook.net/en_US/fbevents.js</code></p>
<p>Loaded on frontend pages when a Pixel ID is configured. The SDK is hosted by Meta.</p>
<ul>
<li><a href="https://www.facebook.com/terms.php" rel="nofollow ugc">Meta Terms of Service</a></li>
<li><a href="https://www.facebook.com/privacy/policy/" rel="nofollow ugc">Meta Privacy Policy</a></li>
</ul>
<h4>Privacy</h4>
<p>For server-side events, all personal data is SHA-256 hashed before transmission. For browser events, the Meta Pixel SDK handles hashing via Advanced Matching. This plugin does not store raw PII in its own tables. See <a href="https://www.facebook.com/privacy/policy/" rel="nofollow ugc">Meta’s privacy policy</a>.</p>
<h4>Cookies</h4>
<ul>
<li><code>cs_uid</code> — Random visitor identifier for <code>external_id</code> deduplication. 180 days. No PII.</li>
<li><code>_fbc</code> — Meta Click ID. Set by Meta SDK on ad click. CapiFlow reads/extends server-side. 180 days.</li>
<li><code>_fbp</code> — Meta Browser ID. Set by Meta SDK. CapiFlow reads/extends server-side. 180 days.</li>
</ul>
<p>All cookies are first-party and contain no personally identifiable information.</p>
<h4>Data Storage</h4>
<ul>
<li><code>{prefix}_capiflow_events</code> — Queued/sent event payloads. Auto-purged after delivery.</li>
<li><code>{prefix}_capiflow_analytics</code> — Daily aggregated analytics. Auto-purged by retention settings.</li>
<li>Order metadata with <code>_capiflow_</code> prefix. Removed on uninstall if “Keep Data” is disabled.</li>
<li>Logs in <code>wp-content/uploads/capiflow-logs/</code> with <code>.htaccess</code> protection. Auto-cleaned daily.</li>
</ul>
<h4>Consent</h4>
<p>By default, events fire once configured. Enable “Consent Enforcement” in Settings to respect CMP signals for both browser and server events.</p>
<p>Supported CMPs: CookieYes, Complianz, CookieBot, GDPR Cookie Consent. Custom integration via <code>capiflow_has_tracking_consent</code> filter.</p>
<p>When Consent Enforcement is enabled, browser and server-side events are blocked until valid tracking consent is detected.</p>
<p>Store owners are responsible for lawful consent configuration where required by privacy regulations.</p>


CapiFlow – Conversions API (CAPI) Tracking for WooCommerce

Send WooCommerce events to Meta Conversions API with server-side tracking, deduplication, and confirmed Purchase control.

ClickTrail – UTM, Click ID & Ad Tracking (with Consent) vs CapiFlow – Conversions API (CAPI) Tracking for WooCommerce