Pixel Made Simple

Description

Pixel Made Simple is a deliberately minimal tracking plugin. No jQuery, no frameworks, no DOM listeners in the frontend – just the official platform loaders (loaded asynchronously) plus a few lines of inline code.

What the plugin does

• Meta Pixel + Conversions API (CAPI): Browser pixel and server-side events from the same WordPress request. Every event gets one UUID that is passed to both fbq() (eventID) and the Conversions API (event_id), so Meta deduplicates the pair automatically.
• Fire-and-forget CAPI: Server-side events are sent non-blocking via wp_remote_post() – no impact on page load time. user_data contains client IP, user agent, the _fbp/_fbc cookies (with a fallback from fbclid) and – optionally – the SHA-256 hashed email address of logged-in users.
• Google Ads (gtag.js): Conversion tracking with your Google Tag, including Google Consent Mode v2 defaults – ad_storage, ad_user_data, ad_personalization and analytics_storage start out as “denied” and your banner sends the update. Form leads additionally carry Enhanced Conversions data, hashed to Google’s own rules (they differ from Meta’s, so both values are carried separately).
• Google Analytics 4: Reuses the same gtag.js loader – enter the Measurement ID and page views and events are picked up. Independent of Google Ads above.
• TikTok Pixel: The official web events, fired with the same event ID as the matching Meta event.
• URL-based events: Define any number of URL rules (“exact path” or “URL contains”) that fire a standard or custom event on Meta, Google Ads and TikTok at once, e.g. Lead on /thank-you/. Ideal for thank-you and confirmation pages.
• Handover to the confirmation page: A confirmation page does not know the email address, so on its own it can only pass on IP and user agent – and Meta barely uses such a server event for attribution. With form lead tracking enabled, the submission hands its event ID and its hashed contact data to the next page through the browser’s sessionStorage. A matching URL rule there reports the same event instead of a second one: if the submission got through, Meta deduplicates the pair; if it was lost during the redirect, the confirmation page is its full replacement. Either way one conversion – with email and phone in the match. With Google Ads configured, the same conversion also carries Enhanced Conversions data (gtag('set','user_data', …)), hashed to Google’s own rules – they differ from Meta’s, so both values are carried separately.
• Automatic form lead tracking (off by default): Detects submissions of Contact Form 7, Elementor Pro, Fluent Forms, WPForms, Gravity Forms, SureForms and plain HTML forms and fires Lead or Contact in the browser and via CAPI with the same event ID. Email and phone number are hashed with SHA-256 before they leave your server; raw values are never stored or logged. Optional URL filter and automatic exclusion of search, comment and login forms. Submissions that redirect to a confirmation page hand their data over to it (see above).
• GDPR cookie banner detection (on by default): Recognises Must Have Plugins Cookie Bar, Borlabs Cookie, Complianz, Real Cookie Banner, CookieYes, Cookiebot, SureCookies and any banner that implements the WP Consent API, and holds back browser and server events until the visitor grants marketing consent. Tracking starts right after the click on “Accept” – no reload. Sites without a cookie banner are never blocked. A consent mode lets you choose whether server-side events wait for the banner as well (recommended) or only the browser pixel does.
• Cookieless analytics (Plausible, Umami, Rybbit): Load the base script of a privacy-friendly analytics provider straight from the Privacy Trackers tab – two fields per provider, the script URL from your dashboard and the site identifier. Deliberately limited to the base script: no custom events, no goals, no server-side connection. Each provider has its own Load without consent switch (off by default); when it is off the tracker waits for consent exactly like the advertising pixels, and when it is on it loads immediately – for that one provider only, while Meta, Google and TikTok stay blocked. Nothing at all is written to your page source until a provider is switched on and both of its fields are filled.
• Event log: A small table in your WordPress admin lists the most recent browser and server-side events (event name, event ID, platform, status, match keys) so you can verify your setup without leaving WordPress. Filter by status, event name or platform; entries are deleted automatically after 3, 7, 14 or 30 days, whichever you choose.
• Live debug bar for administrators: A discreet bar at the bottom of the frontend shows consent status (including the detected banner), fired events, event IDs, the CAPI response and the match keys used. Rendered exclusively for logged-in administrators – regular visitors get zero additional bytes.
• Test event code with auto-expiry: The Meta test event code is removed automatically after 12 hours, so no test traffic ends up in your live reports by accident.
• Privacy by default: Form lead tracking is disabled on new installations, the CAPI access token is only ever used server-side and never rendered in the frontend, and the event log stores field names only – never values or hashes.
• Consent statistics: One card above the event log answers a single question – how much of your tracking is the cookie banner eating? Aggregated daily counters only, for 7 or 30 days, with a daily breakdown and a CSV export.
• Export & import: Download the whole configuration as JSON and apply it on another site in one step.
• Translation-ready: English source strings and a POT template are included; German and other locales come from translate.wordpress.org.

Pixel Made Simple Pro

Everything described above is included here, without limits or license checks. Pixel Made Simple Pro is a separate plugin for online shops and campaign attribution. It adds WooCommerce and SureCart tracking (ViewContent, AddToCart, InitiateCheckout and Purchase for all four platforms, with a server-side Purchase fallback and optional advanced matching), the TikTok Events API for server-side purchase events, and first-touch/UTM attribution with automatic form fill. Both plugins use the same option keys, so switching between them keeps your configuration.

External services

This plugin connects to third-party tracking services. Nothing is sent until you enter the respective ID/token and switch the platform on. With cookie banner detection enabled, nothing is sent before the visitor has granted marketing consent either – the one exception is a privacy tracker whose Load without consent switch you have turned on yourself, and that exception applies to that provider alone.

Meta (Facebook) – Meta Pixel and Conversions API

• The browser loads the official pixel script from https://connect.facebook.net/ and sends events to https://www.facebook.com/tr (including the <noscript> fallback image). This happens on every page view for which tracking is active.
• The Conversions API request goes from your server to https://graph.facebook.com/ whenever a URL event matches or a tracked form is submitted (for a URL event that takes part in the handover to the confirmation page, the browser asks your server to send it). It contains the event name, time, event ID, page URL, the visitor’s IP address and user agent, the _fbp/_fbc cookie values if present and – only where enabled – SHA-256 hashes of the email address/phone number (form leads, logged-in users) or of billing details (Pro e-commerce tracking).
• Terms of service: https://www.facebook.com/legal/terms – Privacy policy: https://www.facebook.com/privacy/policy/ – Platform terms: https://developers.facebook.com/terms/

Google – Google Ads and Google Analytics 4

• The browser loads gtag.js from https://www.googletagmanager.com/ and sends page views, conversions and e-commerce events to Google Ads / Google Analytics. For form leads the conversion additionally carries SHA-256 hashes of the email address and – where an international number is available – the phone number (Enhanced Conversions). For purchases with advanced matching enabled it carries the same two plus hashed first and last name, and city, region, postal code and country in the clear. There is no server-side connection to Google. With Consent Mode v2 enabled, all consent signals default to “denied” until your banner updates them. There is no server-side connection to Google.
• Terms: https://policies.google.com/terms – Privacy: https://policies.google.com/privacy – Google Analytics terms: https://marketingplatform.google.com/about/analytics/terms/us/

TikTok – TikTok Pixel and Events API (the Events API is part of Pixel Made Simple Pro)

• The browser loads the pixel from https://analytics.tiktok.com/ and sends web events to TikTok. For purchases the server additionally sends an Events API request to https://business-api.tiktok.com/ containing the event, event ID, IP address, user agent, order values and – only where enabled – the hashed email address and, where an international number is available, the hashed phone number.
• Terms: https://www.tiktok.com/legal/page/global/terms-of-service/en – Privacy: https://www.tiktok.com/legal/page/row/privacy-policy/en – Business products terms: https://ads.tiktok.com/i18n/official/policy/business-products-terms

Plausible, Umami and Rybbit – cookieless analytics (all off by default)

• Unlike the platforms above, the address contacted here is not part of the plugin. You paste the script URL from your own dashboard into the Privacy Trackers tab; the plugin ships no default and never assembles one from a host name. Which server receives the data therefore depends on your account – the provider’s cloud for a hosted plan, your own machine for a self-hosted instance. The example addresses shown in the empty fields are placeholders, never sent.
• Nothing is loaded for a provider until you switch it on and fill in both of its fields. Until then not a single line for it appears in your page source.
• Plausible: the browser loads the script from the address you entered (typically https://plausible.io/js/script.js) and reports a page view for every page on which tracking is active, tagged with the domain you entered. Service: https://plausible.io/ – Terms: https://plausible.io/terms – Privacy: https://plausible.io/privacy – What Plausible collects: https://plausible.io/data-policy
• Umami: same, from the address you entered (typically https://cloud.umami.is/script.js), tagged with the website ID you entered. Service: https://umami.is/ – Terms: https://umami.is/terms – Privacy: https://umami.is/privacy
• Rybbit: same, from the address you entered (typically https://app.rybbit.io/api/script.js), with the site ID appended to the URL as ?siteId=. Service: https://www.rybbit.io/ – Terms: https://www.rybbit.io/terms-and-conditions – Privacy: https://www.rybbit.io/privacy
• The plugin loads each provider’s base script and nothing else: no custom events, no goals, no e-commerce data, and no server-side connection of any kind. What that script then collects is the provider’s business and is described in their own documentation above.
• Consent: by default each provider waits for marketing consent exactly like the advertising pixels, and starts without a page reload once the visitor accepts. The per-provider Load without consent switch changes that for that one provider only – Meta, Google and TikTok stay blocked either way.

SureCart – licensing and automatic updates (Pro only)

• The Pro version activates its license and checks for updates against https://api.surecart.com. This happens when you activate or deactivate a license on the “License” page, and when WordPress checks for plugin updates (the result is cached for three hours). Transmitted are the license key you entered, your site URL and your site title.
• The free version never contacts this service. It is updated through WordPress.org and contains no update checker of its own.
• Terms: https://surecart.com/terms-and-conditions/ – Privacy: https://surecart.com/privacy-policy/

A freshly activated Pixel Made Simple contacts nothing at all: with no platform configured, the plugin writes no third-party script, image or request into your pages. Every connection described above needs a setting you made yourself. The settings pages link to https://pixelmadesimple.com (documentation, tutorials, Pro upgrade). These are plain links – no data is transmitted unless you click them. The free version contains no update checker or telemetry of its own; updates come from WordPress.org.

Privacy

• Personal data is only ever sent to the platforms above, never stored by the plugin. Email addresses and phone numbers from form submissions are hashed (SHA-256) in memory and discarded.
• The event log stores event names, event IDs, status codes and the names of the match keys used (e.g. em, fbc) – never the values.
• The consent statistics store aggregated daily counters only: one row per calendar day with three integers (sent, blocked by consent, not configured). There is no IP address, no user agent, no event ID and no timestamp below day level – the plugin does not and cannot track who declined consent. Rows older than 30 days are deleted automatically.
• The handover to the confirmation page uses the browser’s sessionStorage and holds an event ID plus SHA-256 hashes – four of them since 0.11.1 (Meta and Google normalise differently), never a plain-text email address or phone number. The entry is never sent to the server, does not survive closing the tab, expires after 10 minutes and can be used exactly once. In the default consent mode it is not created at all without marketing consent.
• The first-touch attribution cookie pxms_attribution (Pro, off by default) stores UTM parameters and click IDs for 30 days in a first-party cookie.
• Please check with your data protection officer whether the “Block browser pixels only” consent mode is permissible for your site; the default (“Fully GDPR compliant”) blocks server-side events as well.