TrackSure – Server-Side Tracking for WooCommerce & FluentCart

★ What Makes TrackSure Different

TrackSure combines server-side conversion tracking (Meta Conversions API + GA4 Measurement Protocol) with a complete first-party analytics dashboard — user journeys, funnels and attribution — inside WordPress. No GTM, no server container, no external cloud and no monthly fees.

Ad blockers and browser privacy limits stop many pixel events from reaching the ad platforms. TrackSure also sends each event from your WordPress server, under the same event ID as the browser pixel, so the platforms receive it once even when the browser copy is blocked. Paste your Meta Pixel ID (and optionally an Access Token) or your GA4 Measurement ID, and TrackSure handles the browser pixel, the server copy, deduplication and Advanced Matching for a higher Event Match Quality (EMQ).

For WooCommerce and FluentCart Store Owners

If you sell with WooCommerce or FluentCart and advertise on Meta or Google, TrackSure sends your real orders to the ad platforms from your server as well as from the browser, so sales stopped by ad blockers and browser limits still count. Both shops are tracked automatically — product views, add to cart, checkout, payment info and purchase — with no setup beyond your Pixel ID or Measurement ID.

For Marketers & Agencies

Get user journey tracking, funnel visualization, multi-touch attribution and traffic source analysis without a separate analytics subscription. Five attribution models and an assisted conversions report show which channels drive revenue.

For Developers

TrackSure exposes a JavaScript API (window.TrackSure.track()), a PHP API, and WordPress hooks (tracksure_filter_event_data, tracksure_conversion_recorded) for custom event tracking with full server-side control — no dependency on browser JavaScript.

window.TrackSure.track('button_click', { button_name: 'Download PDF' });

Documentation | Support | GitHub | Get Pro

What TrackSure Does

Server-Side Conversion Tracking (CAPI)

• Meta Conversion API — send purchase, view content, add to cart, checkout, and page view events server-to-server
• Google Analytics 4 Measurement Protocol — server-side GA4 event forwarding
• TikTok Events API and Pinterest Conversion API (Pro)
• Automatic browser + server event deduplication — each event gets a unique ID shared between client and server so platforms count it once

First-Party Analytics Dashboard

• All analytics data stored in your WordPress database — you own every byte
• Automatic traffic source detection — organic search (Google, Bing, DuckDuckGo), social media (Facebook, Instagram, LinkedIn, TikTok), email, referrals, AI chatbots (ChatGPT, Claude, Perplexity), and direct — identified without UTM tags
• Session-based user journeys with 30-day attribution window (configurable) — complete path from first visit to conversion, including every touchpoint across multiple sessions
• Five attribution models: first-touch, last-touch, linear, time-decay, position-based
• Assisted conversion reporting — see which channels helped even without getting final credit
• Real-time visitors — see who is on your site now and what pages they’re viewing

Goals, Funnels & Conversion Tracking

• Custom conversion goals for form submissions, purchases, downloads, video views, or any event
• Funnel visualization — see where visitors drop off in your checkout or signup flow
• Goal completion rates with trend analysis
• Revenue attribution — connect each sale to its traffic source, campaign, and touchpoint

eCommerce Conversion Tracking

• Auto-tracks the full purchase funnel: product view → add to cart → checkout → purchase
• Works with WooCommerce and FluentCart (Free), Easy Digital Downloads, SureCart and CartFlows (Pro)
• Revenue attribution — connect each sale to its traffic source and campaign
• Checkout funnel visualization with drop-off rates at each step

Privacy & Compliance

• Consent plugin support (Cookiebot, CookieYes, OneTrust and more) and Google Consent Mode v2
• Cookieless tracking option (uses localStorage instead of cookies)
• IP anonymization, Do Not Track (DNT) support, and WordPress privacy tools integration
• No data leaves your server unless you enable an ad platform destination — with the single exception of the optional IP geolocation lookup, which can be switched off in Settings → Privacy

Free vs Pro

Free includes everything you need for analytics and conversion tracking:

• First-party analytics dashboard with user journeys, funnels, goals, and attribution
• Real-time visitor tracking
• Meta Pixel (formerly Facebook Pixel) + Conversions API (CAPI) server-side tracking
• Google Analytics 4 + Measurement Protocol server-side tracking
• WooCommerce and FluentCart automatic ecommerce tracking
• All form plugins (Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Elementor Forms)
• All page builders (Elementor, Divi, Beaver Builder, Gutenberg, WPBakery, Oxygen, Bricks)
• Five attribution models with assisted conversion reports
• Consent management integration
• Unlimited events and sessions

Pro adds more ad platforms and integrations:

• More ad platform destinations, including TikTok, Reddit, Google Ads, Pinterest, LinkedIn and Snapchat
• More eCommerce integrations: Easy Digital Downloads, SureCart and CartFlows
• Priority support

Compare Plans

Getting Started

1. Install and activate TrackSure from the WordPress plugin directory
2. Visit TrackSure → Settings to review tracking and privacy options
3. (Optional) Add your Meta Pixel ID + Access Token or GA4 Measurement ID for server-side conversion tracking
4. Go to TrackSure → Overview — analytics data starts appearing after 1 hour

External services

This plugin connects to external third-party services to provide its functionality. Below is a complete list of all external services used, when they are called, what data is transmitted, and links to their terms of service and privacy policies.

When You Enable Meta Pixel / Conversion API:

• Service: Meta (Facebook) Graph API
• Purpose: Send conversion events (purchases, add-to-cart, page views) to Facebook for ad optimization
• What data is sent: Event name, timestamp, hashed user email/phone (if available), product SKU, revenue, IP address, user agent, pixel ID
• When it’s sent: Automatically when a tracked event occurs (product view, purchase, etc.) and Meta destination is enabled in settings
• Service provider: Meta Platforms, Inc.
• Terms of Service: https://www.facebook.com/legal/terms
• Privacy Policy: https://www.facebook.com/privacy/policy
• Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing

When You Enable Google Analytics 4:

• Service: Google Analytics 4 Measurement Protocol
• Purpose: Send analytics events to Google Analytics for website traffic analysis
• What data is sent: Event name, page URL, referrer, session ID, client ID, IP address, user agent, device information
• When it’s sent: Automatically when page views or custom events occur and GA4 destination is enabled in settings
• Service provider: Google LLC
• Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/
• Privacy Policy: https://policies.google.com/privacy

When Loading Google Tag Manager Script (If Enabled):

• Service: Google Tag Manager CDN
• Purpose: Load gtag.js library for browser-side Google Analytics tracking
• What data is sent: Standard HTTP request data (IP address, user agent, referrer) when loading the script
• When it’s sent: On every page load when GA4 browser tracking is enabled
• Service provider: Google LLC
• Script URL: https://www.googletagmanager.com/gtag/js
• Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/
• Privacy Policy: https://policies.google.com/privacy

When Loading Facebook Pixel Script (If Enabled):

• Service: Facebook Connect CDN
• Purpose: Load fbevents.js library for browser-side Facebook Pixel tracking
• What data is sent: Standard HTTP request data (IP address, user agent, referrer) when loading the script
• When it’s sent: On every page load when Meta Pixel browser tracking is enabled
• Service provider: Meta Platforms, Inc.
• Script URL: https://connect.facebook.net/en_US/fbevents.js
• Terms of Service: https://www.facebook.com/legal/terms
• Privacy Policy: https://www.facebook.com/privacy/policy

IP Geolocation (When Tracking Is Enabled):

• Service: ipapi.co (primary), ip-api.com (secondary fallback), WordPress.com Geo API (tertiary fallback)
• Purpose: Determine the country, region, and city of visitors based on their IP address for geographic analytics reporting
• What data is sent: The visitor’s IP address is sent to one of the geolocation providers. No other user data is transmitted.
• When it’s sent: When a new visitor session is recorded and the IP has not been looked up recently. Results are cached for 24 hours per IP.
• Service providers and policies:
  • ipapi.co (primary) – https://ipapi.co/privacy/ and https://ipapi.co/terms/
  • ip-api.com (fallback) – https://ip-api.com/docs/legal
  • WordPress.com Geo API (fallback) – https://automattic.com/privacy/ and https://wordpress.com/tos/
• Local sources are tried first: if your site is behind Cloudflare, has the PHP GeoIP extension, or has a local MaxMind database, the country is read from those and no address leaves your server.
• Transport: ipapi.co and the WordPress.com Geo API are contacted over HTTPS. ip-api.com does not offer HTTPS on its free tier, so that fallback is contacted over plain HTTP — it is only reached if ipapi.co has already failed.
• Turning it off: Settings → Privacy → “Look up visitor location remotely”. Turning it off keeps the local sources above and stops any address being sent to a third party. Developers can also decide per request with the tracksure_remote_geolocation_enabled filter.

Microsoft Clarity (Only If You Enable It):

• Service: Microsoft Clarity, session recordings and heatmaps
• Purpose: Let you watch how visitors use your site, and open the recording of any session TrackSure shows you
• When it’s used: Only after you switch on the Microsoft Clarity integration and enter your own Clarity Project ID. It loads only on pages TrackSure tracks, so excluded visitors (administrators if you exclude them, Do Not Track, excluded IPs) are never recorded. Where your site asks visitors for consent, Clarity loads only after analytics consent is given, and later changes are passed on to it.
• What data is sent: Clarity’s script collects page interactions (clicks, scrolling, mouse movement) and device information as described by Microsoft. TrackSure adds its own random session ID as a custom tag, and marks your own visits as internal. TrackSure sends no names, emails or order details to Clarity.
• Script loaded from: https://www.clarity.ms/
• Service provider: Microsoft Corporation
• Terms of Use: https://clarity.microsoft.com/terms
• Privacy Policy: https://privacy.microsoft.com/privacystatement

Deactivation Feedback (Only If You Choose to Send It):

• Service: TrackSure feedback collector at tracksure.cloud
• Purpose: Learn why people stop using TrackSure, so we can fix it
• When it’s sent: Only when an administrator deactivates TrackSure and clicks “Send & deactivate” in the optional form. “Skip & deactivate” sends nothing, and nothing is ever sent otherwise.
• What data is sent: The chosen reason and any comment typed, the TrackSure, WordPress and PHP versions, the site language, how many days TrackSure was installed, whether WooCommerce and TrackSure Pro are active, and whether the Meta and Google Analytics destinations were switched on. Your site’s address is not sent. Your email address is sent only if you tick “You may email me about this”.
• Retention: Answers are deleted after two years.
• Service provider: TrackSure (tracksure.cloud)
• Privacy Policy: https://tracksure.cloud/privacy-policy
• Turning it off: Use “Skip & deactivate”. Developers can disable the form’s sending entirely with add_filter( 'tracksure_deactivation_feedback_endpoint', '__return_empty_string' );

Destinations are opt-in: nothing is sent to Meta, Google Analytics or any other platform unless you enable and configure it under TrackSure → Connections. IP geolocation, described above, is the one exception, and it can be switched off in Settings → Privacy. Where a consent plugin is installed, TrackSure follows the visitor’s choices.

Source Code & Build Instructions

The admin interface is built with React 18 and TypeScript, compiled with Webpack 5. The compiled files in admin/dist/ are generated from the source code in admin/src/.

Full source code is available on GitHub:
https://github.com/tracksure-cloud/tracksure

To build from source:

1. Navigate to the admin/ directory
2. Run npm install to install dependencies
3. Run npm run build for a production build, or npm run dev for development mode with watch

Build tools used:

• Node.js (v20.19+)
• npm
• Webpack 5 (config: admin/webpack.config.js)
• TypeScript 5 (config: admin/tsconfig.json)
• ts-loader for TypeScript compilation

Key source directories:

• admin/src/ — React/TypeScript source code (pages, components, contexts, hooks)
• admin/dist/ — Compiled production JavaScript (generated by Webpack)
• assets/js/ — Frontend tracking scripts (non-compiled, human-readable)
• includes/ — PHP backend (non-compiled, human-readable)

Privacy Policy

TrackSure stores the following in your WordPress database:

• Visits: pages viewed, referrers, campaign (UTM) parameters, device, browser and operating system, IP address (can be anonymised), session duration and engagement.
• eCommerce (WooCommerce, FluentCart and, in Pro, EDD and SureCart): product views, cart actions and orders (order ID, total, items). A customer’s email and phone number are stored only as SHA-256 hashes.

Privacy controls: IP anonymisation (Settings → Privacy; off by default for accurate location reports), cookieless mode, consent plugin integration (Cookiebot, CookieYes, OneTrust and others), Do Not Track support, configurable data retention, and WordPress’s personal data export and erasure tools.

Data sharing: see “External services” above. Nothing is sent to an advertising or analytics platform unless you enable it.

Your responsibilities: disclose TrackSure’s tracking in your site’s privacy policy, obtain consent where the law requires it, and set data retention to suit your obligations.

Support

Free Support:

• Documentation
• Community Forum

Pro Support:

• Priority email support

Get Pro Support

Trademarks & Third-Party Services

Meta, Facebook, Instagram and Facebook Pixel are trademarks of Meta Platforms, Inc. Google, Google Analytics, Google Ads and GA4 are trademarks of Google LLC. Microsoft Clarity and LinkedIn are trademarks of Microsoft Corporation. TikTok, Pinterest, Snapchat, Reddit and X are trademarks of their respective owners.

TrackSure is an independent plugin and is not affiliated with, endorsed by or sponsored by any of these companies. Using an integration requires your own account with that platform and compliance with its terms.