TrackSure Cloud – Server-Side Tracking, Meta CAPI & GA4 for WooCommerce

Changelog

1.2.9 – 2026-08-26

Traffic sources — where your visitors came from

• Fix: an ad click reached the server with nothing to say it had been paid for. The tracker read every advertising click identifier out of the address — Google, Microsoft, Meta, TikTok, Reddit, LinkedIn, Snapchat, X — and then left all of them behind when it reported the visit, so the server was asked to identify an unlabelled click from a referrer that either named the wrong thing or said nothing at all. A Search ad, which arrives with no referrer, was recorded as direct. On one site this was a fifth of all traffic and almost the whole of its advertising.
• Fix: an ad shown on YouTube was reported as somebody sharing a video. Google identifies a Search ad and a video ad the same way, and only the referrer separates them, so the identifier is now read for whether the visit was paid for and the referrer for where the ad was seen. Ads on YouTube, Vimeo, Dailymotion and Twitch are reported as paid video; ads on a social platform as paid social.
• New: wbraid and gbraid, which Google sends instead of gclid on iOS, and gad_source, which its newer surfaces send on their own. None were read, so those clicks were invisible as advertising.
• New: dclid, for Display & Video 360.
• Fix: a link tagged with a source and no medium was recorded with a medium of “unknown”, which is not a medium — it says the visit could not be classified. What kind of place the source is, is often known: reddit.com is social and bing.com is a search engine, and a source nobody has heard of is a referral rather than a mystery.
• Fix: “unknown” was also being sent to Google Analytics as a medium, where it matches no channel and files the visit under Unassigned. Placeholders are no longer sent at all, which leaves the tag to read the address for itself.

Reports

• Fix: paid traffic was reported as “other” — the bucket for visits nothing is known about — whenever the campaign tagged itself with anything other than cpc, ppc or paidsearch. utm_medium=paid is the common spelling on a hand-tagged Google or YouTube ad, and TrackSure writes paid_social itself for a click on a TikTok, Reddit, X, Snapchat or LinkedIn ad; none of them were recognised. Google Analytics counts all of these as paid, so the two reports disagreed about the same visit. Whether a paid click is search or social is now decided by the source, against the lists already used to identify search engines and social platforms.
• Fix: the traffic sources report could list one campaign twice. Rows were grouped by the channel name recorded at the time as well as by the source, so a campaign whose name had since been corrected split into two rows carrying the same label. The channel is worked out from the source and medium when the report is built, so the stored name is no longer grouped on and existing history is described by the current rules.

Release packaging

• Improvement: the release build now refuses to run while a database dump, archive, environment file or private key is sitting in the plugin folder, naming what it found. The packaging list said what to leave out, so anything it had not heard of was included.

1.2.8 – 2026-08-22

Tracking accuracy

• Fix: “Track Administrators”, when turned off, now stops events the server records as well as those the browser sends — previously a logged-in administrator placing a test order still had that order sent to Meta and GA4, which is the one thing the setting exists to prevent. The check now happens once, at the single point every integration passes through.
• Fix: repeated events in one session are no longer collapsed into a single row — an event carrying nothing to identify it produced the same event id for the whole session, so only the first occurrence was kept
• Fix: session event counts counted recording attempts rather than events, so an action tracked by both the browser and the server counted twice — genuine single-page visits were never counted as bounces, and the better the tracking worked the lower the bounce rate looked
• Fix: aggregate tables treated an unknown dimension (direct traffic, unknown country, unidentified device) as never matching itself, so every aggregation run inserted a new row instead of updating the previous one and those visits were counted once per run
• Improvement: automatic database migration (DB v1.0.4) folds the affected rows together rather than discarding them — counts are summed, nothing is lost, no manual action required
• Fix: consent decisions recorded with an event are no longer re-read at delivery time, when the visitor’s request has long ended

Traffic sources — where your visitors came from

• Fix: Google Ads and Microsoft Ads clicks were reported as free organic search. Both platforms tag their own clicks (auto-tagging is the default) and add no UTM, so the visit arrives from google.com or bing.com looking exactly like an organic search. The click identifier is now read first, so paid clicks are reported as paid — with or without UTM tags.
• Fix: referrers were matched by looking for a domain anywhere inside the hostname, which misfiled a large amount of traffic. Any host containing “t.co” — including chatgpt.com, client.co.uk and most domains ending in “t.com” — was reported as Twitter; “phoenix.com” was reported as X; “disc.com” as Snapchat. Matching is now on the actual domain, so a site is only credited when the visit genuinely came from it.
• Fix: a visit from another website whose domain merely ended with yours was discarded as your own internal traffic.
• Fix: regional search domains (google.co.uk, google.de, google.com.au, yandex.ru and the rest) are now reported as one source instead of being split per country, and lookalike domains such as “notgoogle.com” are no longer counted as Google.
• Fix: AI assistant referrals now work at the addresses those services actually use — chatgpt.com, gemini.google.com and copilot.microsoft.com were all missed, and Gemini was being reported as an organic Google search because it sits on a Google domain.
• Fix: referrals from the Gmail and other mobile apps were reported as organic Google search.
• Fix: a campaign tagged with utm_source but no utm_medium was filed under “other” alongside unclassifiable traffic instead of being reported as a referral.
• Improvement: Ecosia, Brave Search and Startpage are recognised as search engines.
• Fix: Google Analytics was never told where a visitor came from. The traffic source was read from a field nothing ever filled in, and the parameters it would have sent are not ones Google recognises — so every event the browser tag did not report itself, including sales recorded by the shop, arrived at GA4 unattributed. The campaign now travels the way Google documents, under Google’s own parameter names.
• Improvement: a paid click from Microsoft, TikTok, Reddit, Snapchat, X or LinkedIn is now named to Google Analytics as well. Google reads its own click identifiers and the utm_ parameters; nobody else’s means anything to it, so those visits were filed under whatever the referrer suggested, or under no source at all. TrackSure already knows what each identifier means and now tells the tag, reading the same list it attributes by rather than keeping a second one that could disagree.
• Improvement: nothing is claimed over an auto-tagged Google Ads click, or over a link somebody tagged by hand. Naming a source overrides what the address says, and answering “google / cpc” over a click a linked Google Ads account can resolve would trade the campaign, ad group and cost for two words.
• Fix: a branch in the tag’s event mapper would have handed Google a session identifier of TrackSure’s own, filing those events under a session Google never recorded a source against — the same fault the Measurement Protocol side reads the visitor’s cookie to avoid. Nothing ever filled the field it read, so it never ran; it is removed rather than left waiting to.
• Fix: a visitor who bought on their first visit had that visit recorded as a touchpoint two or three times over. Every attribution model that shares credit between touchpoints — linear, time decay, position based — then gave that one source two or three shares of the same sale.
• Fix: coming back later from the same place is now recorded as the separate visit it was. Recorded once, a campaign that kept working looked like one that worked in March and stopped, which is exactly what time-decay attribution is meant to show.
• Fix: the admin screens classified traffic for themselves, in the browser, from a second set of rules that did not match the server’s — matching by fragment, so any source containing “online” was reported as a messaging app, anything containing “aff” as an affiliate, and a link tagged with a source but no medium as direct. Channels are now decided once, where the visit is recorded.
• Fix: Google Analytics counted every visitor’s arrival twice. TrackSure raises its own session_start and first_visit events, and those were passed straight to the Google tag — which raises events of the same names itself, and reserves those names. Two visitors arriving showed as four first_visit and four session_start against two page views.
• Fix: the Google Analytics tag wrote a line to the browser console for every event it handled, on every visit.
• New: the Journeys view shows the whole path a visitor took to reach you, in order — an ad, then a search, then a link from a newsletter weeks later — rather than only the first and last of them.
• Fix: the AI Assistant, Affiliates and Messaging channels were drawn with icons that do not exist, so they appeared blank.

E-commerce and the Products report

• Fix: a product sold in several variations is now counted once rather than once per variation, and each advertising platform is told the kind of id it expects — Meta matches its catalogue on the variation, GA4 joins views to sales on the product, and they genuinely disagree
• Fix: products no longer appear as “Unknown Product” in the Products report
• Fix: the shop’s own pages are no longer listed among its products
• Fix: WooCommerce add-to-cart no longer invents a product name from the button’s text
• Fix: FluentCart — a product with a single buyable option had two identities and was reported twice
• Fix: FluentCart — a product could be reported under a name the shop had never used
• Fix: FluentCart — the checkout no longer renders blank
• New: a setting to choose whether the advertising platforms are told the site’s internal product id or the product’s SKU. The wrong one fails silently, so it is now a choice rather than an assumption. Covers WooCommerce, FluentCart, and the e-commerce integrations in Pro.

Reports, retention and storage

• Fix: the daily product aggregate table was never cleaned up by anything — it was the only table in the plugin that grew without limit, one row per product per day per campaign. The retention period the site chose now reaches it like every other table.
• Improvement: an unused index was dropped from the events table. Its leading column was already the table’s primary key, so it was never used for reading while still being written on every insert, on the largest table the plugin has.
• Improvement: empty values are stored as empty rather than as text that merely looks empty, across every table

Destinations and delivery

• Fix: a delivery run could end in a fatal error at the moment it tried to record a failure
• Fix: a destination that stopped sending in batches could never start again. Batching is abandoned when a platform refuses a whole batch, which is right — but the commonest reason for that is a credential, and credentials get fixed. Any site that had one bad afternoon paid an extra request per event indefinitely, with the settings screen showing everything in order.
• Fix: Meta is told whether an id names a product or a group of variations, in both the browser and server paths

Admin screens

• Fix: every setting inside an integration card was drawn without its on/off switch, so sub-settings appeared as plain unclickable text
• Fix: the “Test connection” button had never appeared for any destination, and Meta had no connection test at all
• Fix: conversion mappings displayed as “[object Object]”
• Fix: destinations showed every field they support rather than the ones the site needs
• Fix: the “Test connection” button was unreadable in the light theme
• Fix: “No such destination, or it is not enabled” was shown to people whose destination exists and is switched on
• Fix: the health panel no longer reports a problem on a correctly configured site — excluding administrators is deliberate and is no longer counted as events being turned away, and a Pro event catalogued but not loaded no longer warns on every install

Admin appearance

• Fix: thirty-three colour and spacing names were used across the admin but never defined anywhere. A name a browser cannot resolve does not fall back — it throws the whole declaration away, in silence. The clearest casualty was the session journey’s conversion funnel, whose bar lost its background while keeping white text: invisible on a light panel, and only looking deliberate in dark mode.
• Fix: the names added for those thirty-three were themselves fixed to the light theme’s colours, so the dark theme drew dark text on its own dark panels. A name defined in terms of another is resolved where it is written, not where it is read, and these were written above the point the theme is chosen.
• Fix: the conversion funnel took its colour from the component rather than from a stylesheet, which put that colour beyond the reach of either theme. A reached purchase and a step not yet reached were among the names that did not exist, so those bars drew no fill at all.
• Fix: on the Integrations and Destinations screens the browser’s own checkbox appeared beside the on/off switch wherever the switch was disabled — WordPress styles a disabled checkbox in a way that outweighed the rule hiding it.
• Fix: the Pages report sized its address column to its contents, so a single checkout link carrying a click identifier pushed views, conversions and revenue off the screen. The address is now bounded and shown in full on hover.
• Fix: a separator drawn in the border colour was all but invisible against the panel behind it.
• Fix: the delivery panel on Diagnostics drew white cards in the dark theme, with the theme’s near-white text on them. The card colour was named once for the light theme in terms of another name, and a name defined that way keeps the answer it had where it was written.
• Fix: nine colours existed only for the dark theme, so the rules asking for them did nothing at all in the light one — among them the danger button, which did not react to the pointer.
• Fix: three names the Goals screens ask for had never been defined, leaving filter and import controls with no hover, no accent border, and an active filter with white text on no fill.
• Fix: a green, amber, red or indigo used as small text reads between 2.1 and 3.6 against a panel, and white on those same colours is no better. Each now has a tone for text and a tone for a filled block, and every rule in the admin asks for the one it means. Roughly 250 rules across every screen.
• Fix: the chart legend took its label colour from the series it describes, which is chosen to stand out against a plot rather than to be read as small text.
• Fix: two spellings of the primary button are in use and only one was styled, so buttons written the other way came out with the panel’s own background behind their white text.
• Fix: milestone buttons put white text on the bright shade of each tier colour; they now use the same hues a step deeper.
• Improvement: nothing in the admin now falls below the readable contrast ratio, in either theme — 3,064 pieces of text across fifteen screens were measured in the browser to confirm it.
• Improvement: colours derived from the theme are written in one place instead of being restated per theme, and eight names nothing asked for were removed.

Removal and cleanup

• Fix: uninstalling left the site running a delivery job every minute, permanently — WordPress reschedules a recurring job whether or not anything still listens for it. Uninstalling now stops it.
• Fix: uninstalling did not remove three integration settings, three per-user dismissed-notice records, or any queued Action Scheduler task
• Fix: development-only files were being included in the released plugin
• Improvement: a quantity of dead and unreachable code removed, including a documented filter that had never been connected to anything

Security

• Fix: hardening of the public event-collection endpoints
• Fix: the single-event collection endpoint recorded no attribution

Compatibility

• Tested with WordPress 7.1.

Pro

• Fix (Pro): licensing was disabled in every downloaded copy — the development-mode flag shipped as a literal “true”. It now defaults to off and is opted into from wp-config.php, and the release build refuses to run if that ever returns.
• Fix (Pro): the minimum free-plugin version check produced a warning and then loaded Pro anyway, causing a fatal error the first time a form was submitted against an out-of-date free plugin
• Fix (Pro): Reddit counted every conversion twice
• Fix (Pro): TikTok was sending nothing usable, in five separate ways
• Fix (Pro): the Microsoft Ads UET tag was never placed on the page
• Fix (Pro): X (Twitter) reported conversions against hard-coded conversion tag ids rather than the site’s own
• Fix (Pro): LinkedIn’s identity block was in a shape LinkedIn does not read
• Fix (Pro): every destination was sent the same phone-number hash, though the platforms do not agree on the format
• Fix (Pro): Experiences targeting silently matched nothing — it read data that was never loaded, queried a column that does not exist, and called geolocation that could never resolve
• Fix (Pro): the daily licence check kept its place in the schedule after the plugin was deactivated

1.2.7 – 2026-07-12

• Fix: GA4 Measurement Protocol events now reuse the visitor’s real GA4 client_id and session_id (captured from the first-party ga / _ga{stream} cookies) instead of a separate TrackSure identity — resolves “(not set)” / Unassigned traffic and doubled sessions in GA4 acquisition reports
• Fix: GA4 server-side delivery now checks browser pixel confirmation before sending — resolves duplicate purchase/ecommerce events appearing twice in GA4 (once with correct source/medium, once as “(not set)”)
• Fix: FluentCart purchase events (order_paid_done) are no longer silently dropped when processed asynchronously via Action Scheduler — affected all payment gateways including Razorpay
• Fix: FluentCart cart and checkout events (view_cart, begin_checkout) now use the store’s actual currency instead of defaulting to USD — affects all non-USD stores
• Fix: Settings now save correctly on sites running LiteSpeed Cache — REST API responses are marked no-cache and page caches are purged automatically after a settings change
• Fix: Reddit tracking — rdt_cid (Reddit click ID) is now captured from ad landing URLs, persisted to sessions, and forwarded to the Reddit Conversions API for proper attribution and deduplication
• Improvement: Automatic database migration (DB v1.0.2) adds rdt_cid column to tracksure_sessions table on existing installs — no manual action required
• Fix (Pro): Reddit Pixel now correctly sends value, currency, transactionId, itemCount, products, and search at the top level of the pixel options object — these params were previously silently dropped inside customEventProperties
• Fix (Pro): Reddit Conversions API server-side events now correctly detect HTTP 200 success responses — previously all API calls were incorrectly reported as failures even when Reddit accepted them
• Fix (Pro): begin_checkout event now maps to Reddit’s InitiateCheckout standard event instead of AddToCart
• Fix (Pro): Removed incorrect uuid field from Reddit CAPI user data — uuid must come from the Reddit Pixel browser cookie, not the server-side event ID

1.2.6 – 2026-05-22

• Fix: Meta Pixel initialized with {autoConfig: false} to prevent Meta’s automatic checkout/purchase event detection from firing a duplicate, parameterless InitiateCheckout alongside TrackSure’s enriched server-side event

1.2.5 – 2026-04-28

• Fix: PHP E_WARNINGs on attribution rows — null coalescing added for first/last touch conversion and revenue fields in query controller
• Fix: DB SQL error “Unknown column dest.destination” in delivery stats — corrected JSON_TABLE alias and join condition in diagnostics controller
• Fix: FluentCart offline/COD purchase tracking — orders with pending payment status (offline_payment method) are now correctly tracked; status list is filterable via tracksure_fluentcart_purchase_statuses
• Fix: GA4 Measurement Protocol session attribution — changed source/medium/campaign to required session_source/session_medium/session_campaign params so active users show traffic source in GA4
• Fix: Pro settings schema now always registered before license gate so REST API accepts tracksure_forminator_enabled and tracksure_bit_form_enabled keys without validation errors

1.2.4 – 2026-04-27

• Improvement: Redesigned admin sidebar navigation — split 11-item Analytics group into 5 focused groups (Analytics, Behaviour, Conversions, Tools, Settings) for better UX
• Improvement: Data Quality moved to Tools group alongside Diagnostics for logical grouping
• Improvement: Conversions group now follows logical setup-to-report order: Goals → Conversions → Attribution
• Improvement: Admin panel default theme set to light mode
• Fix: Dark theme card backgrounds now use opaque tokens (–ts-card-bg) instead of semi-transparent –ts-surface — eliminates white bleed-through in dark mode
• Fix: SVG sparkline gradient IDs sanitized (spaces removed) — resolves invalid SVG spec warning
• Improvement: Sparkline fill color is now neutral indigo (non-alarming) while stroke color reflects trend direction

1.2.3 – 2026-04-19

• Fix: Meta CAPI “Invalid parameter” error — removed unsupported address/ad field from user_data, added strict whitelist of Meta-accepted fields
• Fix: Browser/server race condition — concurrent add_to_cart requests with same event_id caused server’s ecommerce_data to be silently dropped (INSERT IGNORE → ON DUPLICATE KEY UPDATE)
• Fix: Outbox payload merge — when browser event wins the outbox INSERT race, server’s richer payload (items[], value, currency) is now merged back
• Fix: add_to_cart double-counting — browser and server now use item_id as content identifier for deterministic event_id, preventing duplicate events
• Fix: Grouped product add_to_cart — browser no longer fires a hollow add_to_cart for grouped product parent; server correctly fires individual events per child item with full ecommerce data
• Fix: Pipeline diagnostics Section 6 now correctly shows “Skipped” instead of “Pending” for events without destination mapping
• Fix: Pipeline diagnostics Section 10 now correctly shows “Skipped” instead of “Pending” for non-Meta events
• Improvement: Enhanced Meta CAPI error capture with error code and subcode for faster debugging

1.2.2 – 2026-04-13

• Fix: WooCommerce purchase event now uses transactional event_id (order_id based) for reliable Meta CAPI deduplication — consistent with FluentCart
• Fix: Checkout form billing data (email, phone, name, address) was not being saved — replaced dead filter with woocommerce_checkout_order_processed hook
• Fix: Guest user billing fields now enrich EMQ (Event Match Quality) data on the thank-you page for Meta CAPI and server-side destinations
• Fix: Checkout form JS event_id generation corrected from ‘purchase’ to ‘begin_checkout’ — purchase event_id is now transactional

1.2.1 – 2026-04-06

• Fix: Resolved 9,234+ PHPCS coding standards violations across 22 files via auto-formatter
• Fix: Fixed 3 PreparedSQL placeholder errors in dynamic database INSERT queries
• Fix: Fixed undefined $event variable bug in event builder — page context data (title, URL, referrer) was not being passed to validated params
• Fix: Added strict comparison (true) to all in_array() calls for type safety
• Fix: Changed urlencode() to rawurlencode() for RFC 3986 compliant URL encoding in geolocation
• Fix: Converted loose == comparisons to strict === with proper type casting
• Improvement: Updated PHPCS ruleset to suppress VIP-specific false positives for non-VIP hosting
• Improvement: Suppressed noisy warnings (commented-out code detection, unused hook params, global redeclarations)

1.2.0 – 2026-04-04

• Improvement: Meta EMQ (Event Match Quality) now sends full user data (em, fn, ln, ph, ct, st, zp, country) with purchase events for both WooCommerce and FluentCart
• Improvement: FluentCart purchase events now pull billing address data (name, phone, city, zip) from order addresses instead of sparse customer profile
• Improvement: Meta pixel sender re-initializes fbq with per-event user_data before firing for accurate Advanced Matching
• Fix: FluentCart EMQ was only sending country, state, and external_id — now sends all available checkout fields

1.1.0 – 2026-04-01

• New: Milestone celebrations — celebrate visitor milestones (1/50/100/500/1K/5K/10K) and conversion milestones (1/10/50/100/500) with confetti burst animations
• New: Tier-based celebration themes — starter, growing, popular, champion, and legendary tiers with unique colors and icons
• Improvement: Loading spinner no longer conflicts with other plugin spinner styles
• Fix: Light theme button text now uses solid white color for consistent readability
• Fix: Dark mode milestone toast backgrounds are now opaque for better text readability

1.0.5 – 2026-04-01

• New: SEO-friendly plugin name for better WordPress.org search visibility (server side tracking, meta pixel, CAPI, WooCommerce)
• New: Onboarding welcome banner after first activation — guides users through Live tab, admin tracking, dashboard timing, and CAPI setup
• Improvement: Tracking now enabled by default on fresh installs — users see data immediately without manual configuration
• Improvement: Updated plugin description and tags for better discoverability

1.0.4 – 2026-04-01

• Fix: MariaDB compatibility — replaced MySQL-only JSON ->> operator with JSON_UNQUOTE(JSON_EXTRACT()) for cross-database support
• Fix: Logger column mismatch — aligned code with installer schema (context_json → context, log_id → id)
• Fix: Race condition duplicate entry errors on visitors, sessions, and outbox tables — replaced SELECT-then-INSERT with INSERT IGNORE
• Fix: Added automatic database upgrade mechanism so schema changes apply on plugin update, not just activation

1.0.3 – 2026-03-31

• Fix: Re-release of 1.0.2 (previous SVN upload was corrupted)

1.0.2 – 2026-03-31

• Fix: Journeys page now shows correct total visitor count — previously limited to 50 due to missing server-side pagination
• Fix: Sessions page summary cards (total sessions, conversions, revenue) now display accurate global totals instead of current-page-only counts
• Fix: Filter button labels on Journeys page now show correct counts across all data
• Improvement: Journeys page uses true server-side pagination for better performance with large datasets
• Improvement: Frontend JS files are now minified (132 KB saved) with SCRIPT_DEBUG-aware switching
• Improvement: Inlined event registry via wp_localize_script — eliminates extra HTTP request on every page load

1.0.1 – 2026-03-03

• Fix: Goal cards now correctly display performance data (conversions, revenue, conversion rate) — batch performance cache was returning data without the expected wrapper key
• Fix: 3 broken goal templates (scroll_depth, time_on_page, video_complete) now fire correctly
• Fix: Goal condition evaluator type coercion — wp_localize_script sends numbers as strings, causing operator comparisons to fail
• Fix: Ecommerce platform detection now recognizes SureCart and FunnelKit
• Improvement: All 6 frontend scripts now use defer loading strategy for better page speed
• Improvement: Conditional script loading — minicart/currency scripts only load when ecommerce is active, goal scripts only when goals exist
• Improvement: Added loading skeleton placeholders on goal cards while performance data loads
• Improvement: PHP goal evaluator uses secondary trigger_type index for faster lookups
• Improvement: Reduced goal cache TTL from 5 minutes to 1 minute for fresher dashboard data
• Improvement: Added auto-refresh (5 min) for performance queries

1.0.0 – 2026-02-05

• Initial release
• Browser tracking SDK with comprehensive event capture
• Server-side integrations (WooCommerce, FluentCart, EDD, SureCart)
• First-party analytics dashboards
• Multi-touch attribution (first-touch, last-touch, linear, time-decay, position-based)
• Meta Pixel + CAPI integration
• GA4 gtag.js + Measurement Protocol integration
• Privacy-first features (GDPR compliance, cookieless mode)
• Performance optimizations (caching, CDN compatibility)