A large share of your visitors never show up in Google Analytics. Ad blockers stop the tracking request before it leaves the browser. Visitors who refuse your cookie banner are dropped by most setups on purpose. Commonly that is 30-50% of your traffic — and those people still browse, still add to cart, and still buy.

So your reports are wrong in a way you cannot see. Revenue in Google Analytics is lower than revenue in your shop. Channels that actually work look mediocre. Every decision you make from that data is made from a partial picture.

Easy Server Side Tracking closes that gap in two ways.

1. Blocked visits come back

The tracking request no longer goes to google-analytics.com, which is the address blockers are built to recognise. It goes to a tracking endpoint that is not on any blocklist, and Google Analytics is fed from there. Nothing on the visitor’s side has to change.

2. Refused consent no longer means nothing

This is the part most setups get wrong. When someone rejects your cookie banner, the usual answer is to send nothing at all — so the visit, and the order, simply disappear from your numbers.

Here the event still arrives in Google Analytics, with everything that identifies the person removed first: no client id, no advertising click id, no campaign, location or browser detail. You keep the visit and the sale in your totals. The visitor stays anonymous. That is exactly what Google Consent Mode is designed for, and it is switched on for you.

The short version: an order is measured whether the visitor blocks trackers, refuses cookies, or closes the tab before your thank-you page loads.

What you get back

Visits, add-to-carts and purchases that used to be invisible
WooCommerce revenue in Google Analytics that lines up with your actual orders
Channel and campaign reports based on nearly all of your traffic instead of the part that got through
A count for every visitor, including the ones who said no — anonymously
A dashboard showing every event received, so you can see what arrives instead of guessing

WooCommerce

Product views, add to cart, checkout steps, shipping and payment, and the purchase itself are tracked out of the box. The sale is sent from your server the moment the order is paid, so it does not depend on the customer returning to your thank-you page — a customer who closes the tab at the payment provider is measured just the same.

What you need

A GA4 Measurement ID and a Measurement Protocol API Secret, both from your own Google Analytics property.
Nothing else. No Google Tag Manager, no server to rent, no container to configure, no licence key.

Setup is a short guided flow: agree to what is shared and create your free account, paste those two credentials, and tell us which cookie banner you use. Complianz, Cookiebot, CookieYes and Iubenda are recognised automatically; anything else can be pointed at your accept and reject buttons. Most sites are done in a few minutes.

Free, and honest about it

The free tier covers 10,000 events per month, does not expire, and is not a trial. No feature is locked or degraded on it. Paid plans only raise the monthly event allowance and how long the dashboard keeps your events.

What we do with your data

We are a proxy, not a data broker. Your events are forwarded to your own Google Analytics property, and a copy is kept so you can see your own event stream. Nothing is sold, shared with third parties, used to build profiles, or combined across customers.

Raw IP addresses are never stored. The IP is used for country lookup and rate limiting, then hashed with a salt that rotates daily and truncated. It cannot be reversed, and the same visitor produces a different hash tomorrow.

Nothing is sent anywhere until you connect. Installing and activating contacts no external service at all. You see exactly what will be shared, tick a box, and press a button.

More information, documentation and pricing: https://www.easyserversidetracking.com/

External services

This plugin connects to the following external services. Each is necessary for the functionality described and is only contacted as documented below.

collect.easyserversidetracking.com (managed ingestion worker)

Provider: Easy Server Side Tracking (operated by Jacht.Digital Marketing).
What it does: Receives event posts from the in-browser tracker, normalizes and deduplicates them, applies bot filtering and consent rules, then forwards to Google Analytics 4 and stores a copy for the dashboard.
What is sent: Each event payload — event name, page URL, page title, referrer, anonymized client/session IDs, consent state, event-specific parameters, and the visitor IP. The IP is used for country lookup and rate limiting and is never stored in raw form — only as a hash of the IP with a salt that rotates daily, truncated, which cannot be reversed and does not link the same visitor across days.
When: Every time a tracked event fires in the visitor’s browser.
Required: Yes — the plugin’s core function is to send events here.
Terms of service: https://dashboard.easyserversidetracking.com/terms-of-service/
Privacy policy: https://dashboard.easyserversidetracking.com/privacy-policy/

dashboard.easyserversidetracking.com (management & provisioning server)

Provider: Easy Server Side Tracking (operated by Jacht.Digital Marketing).
What it does: Provisions a site ID and signing secret for this site so the ingestion worker will accept its events. Your plan, usage, and limits are managed here when you log in to the dashboard.
What is sent: Site URL and admin email (during provisioning / re-provisioning only), and the site ID.
When: Only when you click Create free account or Re-provision. Activating the plugin sends nothing.
Required: Yes, but only once you choose to connect. Activation alone sends nothing; the account is created when you press Create free account during setup.
Terms of service: https://dashboard.easyserversidetracking.com/terms-of-service/
Privacy policy: https://dashboard.easyserversidetracking.com/privacy-policy/

Google Analytics 4 (Measurement Protocol)

Provider: Google LLC.
What it does: Receives analytics events forwarded by the managed worker (or, when configured locally, sent by the WordPress site directly).
What is sent: GA4 Measurement Protocol payloads — event name, parameters, client_id, optional user_id, optional consent flags. Sent to https://www.google-analytics.com/g/collect or https://www.google-analytics.com/mp/collect.
When: Every event the worker forwards (or every event your WP site forwards in direct-mode).
Required: Yes if you want events to appear in GA4. The plugin does not function as an analytics tool without GA4 (or another Measurement Protocol target).
Terms of service: https://marketingplatform.google.com/about/analytics/terms/us/
Privacy policy: https://policies.google.com/privacy

googletagmanager.com (gtag.js)

Provider: Google LLC.
What it does: Serves the gtag.js library to the visitor’s browser for client-side GA4 measurement.
What is sent: Standard gtag.js telemetry while the script is loaded (page views, automatic events). Its measurement requests are routed through your own site rather than straight to Google.
When: On every pageload, after the visitor has given consent. No request is made before consent, and none is made at all until you have connected your site.
Required: Yes. gtag.js provides the GA4 session and engagement signals the plugin cannot reproduce on its own.
Terms of service: https://marketingplatform.google.com/about/analytics/terms/us/
Privacy policy: https://policies.google.com/privacy

Privacy

This plugin does not collect or store personal data on the WordPress site itself. All event data is sent to the external services listed above and stored there subject to those services’ privacy policies.

The plugin stores the following non-personal data in WordPress options for its own operation:

esst_site_id — the site identifier returned by the management server.
esst_signing_secret — the HMAC signing secret for the managed ingestion endpoint (encrypted at rest).
esst_collect_url, esst_plan_summary — operational state from the management server (collect endpoint URL and the plan name shown in the admin).
jachtsst_user_opt_in_at, jachtsst_user_opt_in_by, jachtsst_user_opt_in_text — the record of who agreed to the data sharing, when, and the exact wording they agreed to. This is kept so the consent can be evidenced later, and includes the WordPress user ID of the administrator who ticked the box. It is never sent anywhere.
jachtsst_setup_completed_at, jachtsst_cmp_choice — setup progress, so the guided setup does not reappear.

The plugin sets one first-party cookie of its own, esst_click_id. It holds the Google click identifier (gclid, gbraid or wbraid) from the advertisement a visitor arrived through, so that a resulting WooCommerce order can record which ad it came from. It is set only after the visitor has given advertising consent, expires after 90 days, and is never sent anywhere by the plugin — it is read back on this site only, when an order is created. It contains no personal data.

Alongside it the in-browser tracker uses the first-party cookie named _ga (the standard GA4 client identifier) when present.

When an order is created and that cookie is set, three values are stored on the order: _esst_click_id, _esst_click_id_type and _esst_click_id_stored_at. They stay on your own site.