Server-side tracking for Shopify and WooCommerce

Why browser pixels miss purchases

Ad blockers stop many pixel requests, and Safari caps cookies set by scripts at seven days, so a buyer returning after a week can look organic. Server-side tracking sends the purchase from your order data to each platform's API, with the click id saved at the first landing.

How it works

1. Capture the click

The script reads the click ids fbclid, gclid, gbraid, wbraid, ttclid, msclkid, ScCid, epik, rdt_cid, twclid, tblci, li_fat_id, adct, aleid, alart, oppref, awc, im_ref and OutbrainClickId, plus all six UTM fields, and stores them against a first-party visitor id, the _tl cookie. On Shopify the visitor id is also written to the cart.

2. Collect first-party

• Shopify app proxy. The storefront posts events to yourstore.com/apps/roasaurus/e, which Shopify signs and forwards. Same-origin, no DNS change, with the regular collector as fallback.
• CNAME subdomain. Point t.yourstore.com at ROASaurus and a certificate is issued automatically. The script and events then load from your own subdomain, so ad blockers treat them as first-party, and the visitor id is also set as a server cookie there. Safari may still cap that cookie at 7 days.

3. Match the order

On Shopify, orders are matched through cart attributes, cart and checkout tokens and the checkout pixel. The purchase is sent from the orders/paid webhook after a 20-second hold, so the browser checkout event (IP, user agent, fbp) can be joined first. Cash on delivery and external checkouts send when the order is created.

The WooCommerce plugin stores the tracking cookies on each order. Platforms without cart attributes match by the thank-you page Purchase event, then a hashed email the visitor gave earlier on your site (in a popup or through an Identify call), then the same IP and browser seen from three hours before to 15 minutes after the order, when exactly one visitor fits. See other webshops and funnels.

4. Send to every platform

ROASaurus forwards PageView, ViewContent, AddToCart, InitiateCheckout, Purchase and Lead. Each server event carries SHA-256 hashed customer data, the platform's own click id, IP address and user agent.

Deduplication, consent and bots

Deduplication. The browser pixel fires with the same event id as the server event, so the platform keeps one copy. Double counting usually means another app sends the same pixel; here is the fix.

Consent. With "Respect visitor consent" on (the default), Shopify's customer privacy API or your consent tool decides. If a visitor declines marketing cookies, they get no visitor id, so their ad clicks and visits are not linked to them, and their browser events are not sent to ad platforms. The paid order itself is still sent server-side with hashed order data to Meta, TikTok, Snapchat, Pinterest, Reddit, X, Microsoft Advertising and Taboola; LinkedIn and the destinations added after it get nothing. In strict mode nothing is sent from the browser until the visitor consents. See consent and privacy.

Bot filter. Crawlers, link previewers, uptime checks, AI bots and headless automation are dropped before the event log or any send.

Event and delivery log. Every delivery is listed per platform with the request and the platform's response. Failed deliveries are retried with backoff.

Who it is for and setup

Stores that advertise on Meta, TikTok or other paid channels and want those platforms to see every purchase. On Shopify, setup takes about ten minutes: connect the store, switch on the theme app embed, paste the checkout pixel and add your ad platforms. Guides: Shopify, Meta, WooCommerce and custom sites. Integrations: Shopify, Meta, TikTok, Google Ads and more.

Limits

• X, Microsoft Advertising, Taboola, LinkedIn, Criteo, AdRoll and Outbrain get their conversions from the server only.
• Taboola postbacks only work after a Taboola click (tblci) and return no validation, so failures cannot be detected.
• Microsoft's UET Conversions API is in limited rollout.
• Outside Shopify, consent is read from OneTrust, Cookiebot, Usercentrics, Didomi, CookieYes, iubenda, Termly, Complianz, Osano, TrustArc, any IAB TCF banner, Google Consent Mode and the WP Consent API. Other banners pass the choice with tlq('consent', …).

Further reading: server-side tracking on Shopify and the Meta Conversions API.