firepixel

FirePixel for WooCommerce connects your WooCommerce store to the <a href="https://firepixel.io" rel="nofollow ugc">FirePixel</a> platform, enabling server-side conversion tracking for Facebook/Meta Ads, TikTok Ads, and Google Ads.
Key Features:
<ul>
<li>Server-side event delivery via FirePixel API — helps reduce signal loss from ad blockers, browser restrictions, and iOS privacy changes</li>
<li>Automatic tracking of key WooCommerce events: AddToCart, RemoveFromCart, ViewCart, ViewContent, InitiateCheckout, Purchase, OrderStatusChanged, and more</li>
<li>Frontend pixel/tag script injection for supported ad platforms when configured</li>
<li>Event deduplication to help prevent double-counting</li>
<li>Background async event queue — no impact on page load time</li>
<li>Debug logging via the WooCommerce logger</li>
<li>Quick Connect flow for easy API key setup</li>
<li>Multi-platform ad tracking support for Meta/Facebook, TikTok, and Google Ads</li>
</ul>
Tracked Events:
<ul>
<li>AddToCart</li>
<li>RemoveFromCart</li>
<li>ViewCart</li>
<li>ViewContent (product pages)</li>
<li>InitiateCheckout</li>
<li>Purchase</li>
<li>OrderStatusChanged</li>
</ul>
<h3>External services</h3>
This plugin connects to external services to deliver server-side conversion tracking and to inject client-side pixel/tag scripts on your storefront. Below is a full disclosure of each service, what data is sent, and when.
<h4>FirePixel API (api.firepixel.io)</h4>
This is the core service this plugin is built around. When the plugin is enabled and a tracked WooCommerce event occurs, such as AddToCart, ViewContent, InitiateCheckout, Purchase, or OrderStatusChanged, it queues an event payload in the database and sends it asynchronously to the FirePixel API in the background via WooCommerce Action Scheduler. WP-Cron is used only if Action Scheduler is not available.
The payload may include the event name, product or order data such as IDs, names, prices, quantities, order totals, currency, and browser signals such as IP address, user agent, referrer, click IDs, cookies, and other attribution parameters used for accurate server-side conversion tracking.
FirePixel may use this data to forward server-side events to the ad platforms configured in your FirePixel dashboard, including Meta/Facebook Ads, TikTok Ads, and Google Ads.
No data is sent unless the plugin is explicitly enabled in settings and valid API credentials are configured.
<ul>
<li>Service provider: FirePixel</li>
<li>Terms of service: https://firepixel.io/terms/</li>
<li>Privacy policy: https://firepixel.io/privacy/</li>
</ul>
<h4>FirePixel App (app.firepixel.io)</h4>
Used only during the Quick Connect setup flow. When a store owner clicks “Quick Connect”, the plugin exchanges an access token with the FirePixel app to retrieve API credentials automatically. The store URL and access token are sent as part of this one-time handshake.
No conversion event data is sent to the FirePixel App during this setup flow, and no setup handshake data is sent after setup is complete.
<ul>
<li>Service provider: FirePixel</li>
<li>Terms of service: https://firepixel.io/terms/</li>
<li>Privacy policy: https://firepixel.io/privacy/</li>
</ul>
<h4>Meta/Facebook Pixel</h4>
If Meta/Facebook Pixel IDs are configured in your FirePixel account, the plugin may inject the Meta Pixel script into frontend pages of your store. This script is loaded in the visitor’s browser and may send browser-side page view and conversion signals to Meta/Facebook.
This only occurs when Meta/Facebook Pixel settings are present in your FirePixel configuration.
<ul>
<li>Service provider: Meta Platforms, Inc.</li>
<li>Terms of service: https://www.facebook.com/legal/terms</li>
<li>Privacy policy: https://www.facebook.com/privacy/policy/</li>
</ul>
<h4>TikTok Pixel</h4>
If TikTok Pixel IDs are configured in your FirePixel account, the plugin may inject the TikTok Pixel script into frontend pages of your store. This script is loaded in the visitor’s browser and may send browser-side page view and conversion signals to TikTok Ads.
This only occurs when TikTok Pixel settings are present in your FirePixel configuration.
<ul>
<li>Service provider: TikTok</li>
<li>Terms of service: https://www.tiktok.com/legal/page/row/terms-of-service/en</li>
<li>Privacy policy: https://www.tiktok.com/legal/page/row/privacy-policy/en</li>
</ul>
<h4>Google Tag Manager / Google Ads (googletagmanager.com)</h4>
If Google Ads or Google Tag IDs are configured in your FirePixel account, the plugin may inject the Google Tag script into frontend pages of your store. This script is loaded directly from Google’s servers in the visitor’s browser and may send page view and conversion data to Google Ads on your behalf.
This only occurs when Google Ads or Google Tag IDs are present in your FirePixel configuration.
<ul>
<li>Service provider: Google LLC</li>
<li>Terms of service: https://policies.google.com/terms</li>
<li>Privacy policy: https://policies.google.com/privacy</li>
</ul>
<h4>Ad platform forwarding</h4>
FirePixel forwards the server-side events it receives to whichever ad platforms you have configured in your FirePixel dashboard, including Meta/Facebook Ads, TikTok Ads, and Google Ads.
The plugin itself sends tracked event data only to FirePixel. FirePixel’s own terms of service and privacy policy govern any onward transmission to third-party ad platforms.
<ul>
<li>FirePixel Terms of service: https://firepixel.io/terms/</li>
<li>FirePixel Privacy policy: https://firepixel.io/privacy/</li>
</ul>

FirePixel for WooCommerce

Server-side WooCommerce conversion tracking for Meta, TikTok, and Google Ads via the FirePixel platform.

shan

Stop paying $30–150/month for a GTM Server Container. Send Conversions API events to Meta, Pinterest, and TikTok directly from your WordPress server. No premium tier, no SaaS subscription.
Three CAPI integrations in one install. Most plugins ship Meta only, or sell Pinterest and TikTok as paid add-ons. This one runs server-side dispatch to all three plus a bundled GTM template for GA4 + Google Ads (Enhanced Conversions, Conversion Linker, click-ID recovery for iOS Safari post-ITP). The same <code>event_id</code> flows browser-side and server-side so each platform deduplicates instead of double-counting.
Aggressive bot filtering, no false-positives on real customers. Layered detection (behavioral signals + ~9,500-CIDR datacenter list + AI-crawler classification for GPTBot / PerplexityBot / ClaudeBot / Google-Extended / Bytespider / etc.) blocks Lighthouse audits, scrapers, and ad-fraud bots. Multi-layered customer bypass — Apple iCloud Private Relay whitelist, ad-click ID recognition (<code>fbclid</code> / <code>gclid</code> / <code>ttclid</code>), logged-in customers, prior-visit <code>_fbp</code> / <code>_ga</code> cookies, Cloudflare Bot Management validation — keeps real shoppers visible. Purchase events are never blocked; pre-Purchase events held by the filter are replayed on eventual checkout so Meta sees the complete funnel.
<ul>
<li>Server-side CAPI to Meta, Pinterest, TikTok — every checkout & cart event, classic + block-based checkout, HPOS compatible. Per-platform retry isolates transient failures.</li>
<li>GTM template for browser-side tags — GA4 + Meta Pixel + Pinterest Tag + TikTok Pixel + Google Ads (Enhanced Conversions enabled, Conversion Linker auto-attached).</li>
<li>Event Log with By-IP view — paginated audit log, customer-protection badges prevent excluding real buyers, one-click exclude for confirmed bots, per-provider breakdown.</li>
<li>GDPR / CCPA modes — honors CMP opt-out signals, strict server-side consent strips PII when consent is denied (browser↔CAPI dedup still works on <code>event_id</code>).</li>
<li>Cache-safe — works with LiteSpeed, WP Rocket, Varnish, Cloudflare full-page cache. Click IDs captured into 1st-party cookies client-side; landing pages stay cacheable.</li>
<li>WP Dashboard widget — queue health at a glance: backlog, oldest pending, last successful dispatch, datacenter exclusions today.</li>
</ul>
If it helps your store, please <a href="https://wordpress.org/support/plugin/easy-meta-capi/reviews/#new-post" rel="ugc">leave a review</a> — it genuinely helps other merchants find this plugin.
<h3>External Services</h3>
This plugin connects your website to external services to send event data.
<ul>
<li>Service Used: Meta Conversion API (graph.facebook.com)
<ul>
<li>Purpose: To send user interaction and e-commerce event data from your server to Meta’s servers for ad performance measurement, optimization, and audience building.</li>
<li>Data Sent: Event details (product ID, price) and user parameters (IP address, user agent, hashed email/name/phone, Facebook cookies) are sent when a user performs a key action.</li>
</ul>
</li>
<li>Service Used: TikTok Events API (business-api.tiktok.com)
<ul>
<li>Purpose: Same as Meta CAPI, providing server-side conversion tracking for TikTok Ads optimization and attribution.</li>
<li>Data Sent: Event details (product ID, price, currency) and user parameters (IP address, user agent, hashed email/phone/external_id, ttp / ttclid cookies) are sent upon user action. Optional under the merchant’s TikTok credentials — the plugin only sends to TikTok if the credentials are configured.</li>
</ul>
</li>
<li>Service Used: Pinterest Conversions API (api.pinterest.com)
<ul>
<li>Purpose: Same as the Meta CAPI, providing reliable tracking for ad performance and audience building on Pinterest.</li>
<li>Data Sent: Event details and hashed user parameters are sent upon user action.</li>
</ul>
</li>
<li>Service Used: Google Tag Manager (googletagmanager.com)
<ul>
<li>Purpose: To load a JavaScript container from Google’s servers that allows you to manage and deploy marketing and analytics tags.</li>
<li>Data Sent: The plugin provides your GTM Container ID to Google to fetch the correct script. GTM itself may collect data based on how you configure your tags.</li>
</ul>
</li>
<li>Service Used: Cloud-provider IP range list — <code>raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses</code>
<ul>
<li>Purpose: Used by the optional Datacenter IP filter to keep the bot blocklist current. Daily background fetch downloads CIDR ranges for AWS, Google Cloud, Azure, Cloudflare, DigitalOcean, Linode, Vultr, Oracle Cloud, and Fastly so events from those ranges can be filtered out before reaching Meta / Pinterest / TikTok.</li>
<li>Data Sent: None. The plugin only downloads public IP-range manifests; no visitor data is sent to GitHub.</li>
<li>License: Source repository is CC0-licensed.</li>
</ul>
</li>
<li>Service Used: Apple iCloud Private Relay egress IP list — same <code>raw.githubusercontent.com/rezmoss/cloud-provider-ip-addresses</code> source (folder <code>apple_private_relay/</code>)
<ul>
<li>Purpose: Used by the optional Datacenter IP filter to whitelist real Apple visitors who exit through Apple’s relay infrastructure. Daily background fetch downloads the merged CIDR list so iOS Safari users on Private Relay aren’t mistaken for datacenter bots.</li>
<li>Data Sent: None. The plugin only downloads the public manifest; no visitor data is sent.</li>
</ul>
</li>
</ul>
Shared hosting note. Some restrictive shared hosts block outbound HTTPS by default. If event delivery silently fails after install, ask your host to whitelist the following domains for outgoing connections: <code>graph.facebook.com</code>, <code>business-api.tiktok.com</code>, <code>api.pinterest.com</code>, and <code>raw.githubusercontent.com</code> (only needed if you keep “Auto-fetched” enabled on the Blocked Traffic tab — covers both the datacenter blocklist and the Apple Private Relay whitelist).
<h3>Advanced Configuration</h3>
Setup details for Consent Mode v2, the strict server-side consent mode (GDPR PII gating), CMP auto-block compatibility, and the WooCommerce Subscriptions integration. None of these are required for a basic CAPI setup — turn them on as your store needs them.
<h3>Consent Mode v2 Setup (GDPR / EU Compliance)</h3>
If you serve EU visitors, GA4 and Meta browser tags don’t fire when consent is denied — typically losing 20–50% of measured event volume. Google Consent Mode v2 recovers this: when consent is denied, GA4 / Meta tags switch to cookieless pings (anonymous beacons carrying event name, value, currency, timestamp but no client identifier). Google’s ML models the conversions from these pings and shows them mixed with observed ones in your reports. A single CMP integration repairs both GA4 and Meta attribution because the Meta Pixel template reads the same consent signals.
How to enable. Popular CMP plugins (Cookiebot, CookieYes, Complianz, Iubenda, Termly, OneTrust) all have a native Consent Mode v2 toggle in their settings — find and enable it. The CMP then calls <code>gtag('consent', 'default', {denied})</code> before GTM loads and <code>gtag('consent', 'update', {granted})</code> after the visitor accepts.
The bundled GTM template includes a paused “Consent Defaults (Pre-CMP)” tag. Enable it only if your CMP doesn’t set <code>gtag('consent', 'default', ...)</code> on its own (rare with modern CMPs).
<h3>Strict server-side consent mode (PII gating for CAPI)</h3>
Consent Mode v2 only controls browser tags. Server-side CAPI fires from PHP, never sees <code>gtag('consent', ...)</code> signals — so it transmits hashed PII regardless of cookie-banner choice. Fine outside the EU; a GDPR concern inside it.
The Privacy & Consent (Server-side) section has a Strict server-side consent toggle (default OFF). When enabled and the visitor has denied marketing consent in your CMP, identifying PII (<code>em</code>, <code>ph</code>, <code>fn</code>, <code>ln</code>, address, <code>fbp</code>, <code>fbc</code> …) is stripped from the CAPI payload. The event still ships with <code>event_id</code>, <code>value</code>, <code>currency</code>, <code>contents</code> — Cookiebot, CookieYes, and Complianz cookies are read automatically; other CMPs supply state via the <code>mcapi_marketing_consent_granted</code> filter.
Why this matters alongside Consent Mode v2. Denied-consent browser pixels switch to cookieless pings — modeled, not observed. With Strict server-side consent ON, your server-side CAPI ships alongside that ping carrying the same <code>event_id</code>. Meta dedupes by <code>event_id</code> and now has an observed server signal feeding the same conversion record the cookieless ping created — cleaner Event Match Quality than browser-only or naïve “send everything” CAPI, and GDPR-defensible because no identifying data leaves your server.
Default OFF preserves match quality for existing non-EU setups. Recommended ON once Consent Mode v2 is configured in your CMP.
<h3>CMP Auto-Blocking and the Plugin’s Inline Scripts</h3>
CMPs with “auto-blocking” (Cookiebot, CookieYes, others) scan every <code><script></code> tag on load and convert anything they suspect of tracking to <code>type="text/plain"</code> until consent. The plugin’s inline scripts only POST first-party events to your own REST endpoint — but a generic auto-blocker can’t tell. To avoid a silent break, every plugin-rendered inline script ships with opt-out attributes for Cookiebot (<code>data-cookieconsent="ignore"</code>), CookieYes (<code>data-cookieyes="cookieyes-necessary"</code>), and Complianz (<code>data-cmplz-no-cookielaw="1"</code>). For other CMPs (OneTrust, Quantcast, in-house), append your own attribute via the <code>mcapi_inline_script_attrs</code> filter.
<h3>WooCommerce Subscriptions Integration</h3>
By default, every WooCommerce Subscriptions auto-renewal sends a fresh <code>Purchase</code> to Meta CAPI — credited to the original acquisition ad. Reported ROAS keeps climbing month after month from the same conversion, polluting optimization signals.
The plugin auto-detects WooCommerce Subscriptions and exposes:
Subscription Renewal Behavior (radio):
<ul>
<li>Default — renewals send as regular <code>Purchase</code>. Existing setups unchanged.</li>
<li>Skip — renewals not sent. Cleanest ROAS hygiene; you forfeit Meta’s LTV signal from renewals.</li>
<li>Tag — renewals still send <code>Purchase</code> but with <code>custom_data.customer_status = "subscription_renewal"</code> so you can filter them in Events Manager.</li>
<li>Subscribe / SubscriptionRenewal events — Meta’s standard <code>Subscribe</code> for sign-ups + a <code>SubscriptionRenewal</code> custom event for renewals. <code>Purchase</code> stays clean, advertisers using LTV-bidding can opt into both.</li>
</ul>
Tag every Purchase with customer_status (checkbox): adds <code>custom_data.customer_status</code> (<code>new_customer</code> / <code>returning_customer</code> / <code>subscription_renewal</code>) to every <code>Purchase</code> so Meta Advantage+ can bid acquisition vs. retention differently. Guest checkouts fall back to billing-email lookup.
<h3>Disclaimer</h3>
This plugin is an independent, community-driven implementation of server-side Conversions API protocols. It is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc., TikTok Ltd., Pinterest, Inc., Google LLC, Automattic Inc., or any other trademark holder referenced herein.
“Meta”, “Facebook”, and the Meta Pixel are trademarks of Meta Platforms, Inc. “TikTok” is a trademark of TikTok Ltd. “Pinterest” is a trademark of Pinterest, Inc. “Google Tag Manager”, “Google Ads”, and “GA4” are trademarks of Google LLC. “WooCommerce” is a trademark of Automattic Inc. All trademark references are used solely for descriptive interoperability purposes — to indicate which platforms this plugin can transmit data to under the merchant’s own configured credentials.
No user data is transmitted to any external service until the merchant explicitly configures their own platform credentials in the plugin settings. The plugin does not “phone home” or contact any developer-controlled server. The only outbound HTTP calls are: (1) merchant-configured CAPI endpoints, (2) the public CIDR manifests at raw.githubusercontent.com used by the optional Datacenter IP filter — no visitor data is sent in those manifest fetches.

CAPI Suite: Meta, Pinterest, TikTok, GTM

Free multi-platform server-side CAPI for Meta, Pinterest, TikTok + GTM dataLayer. Cache-safe, theme-agnostic, no cloud server needed.

FirePixel for WooCommerce vs CAPI Suite: Meta, Pinterest, TikTok, GTM